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1. Introduction 

Quantum key distribution (QKD) protocol proposed by Bennett-Brassard [1] is one 
of the most applicable protocols in quantum information. In the ideal setting, this 
protocol is trivially secure. However, in the real setting, there are two obstacles for 
security. One is noise of the communication quantum channel. Due to the presence 
of the noise, the eavesdropper can leak a part of information behind the noise. The 
second one is the imperfection of the photon source. If the sender sends the two photon 
state instead of the single photon state, the eavesdropper can leak one photon so that 
she can leak information perfectly. Indeed, many realized QKD has been realized with 
weak coherent source. In this case, the photon number of generated state obeys the 
Poisson distribution of average /x, which is called the intensity. The first problem can 
be resolved by combination of the error correction and random privacy amplification 
[2, 3, 4, 5]. Shor-Preskill [2] and Mayes [3] showed that this method gives the secure keys 
asymptorically. Gottesman-Lo-Liitkenhaus-Preskill (GLLP)[6] extended their result to 
the case when the photon source has the imperfection. However, GLLP's result assumes 
the breakdown of photon numbers among received quantum states. Indeed, there is 
possibility that the eavesdropper can control the receiver's detection rate depending on 
the photon number because the different photon number states can be distinguished by 
the eavesdropper. In order to resolve this problem, we need to estimate the detection 
rate among the single photon states. Hwang proposed the decoy method to estimate 
it, in which, the sender randomly changes the intensity [7]. This method has been 
improved by many researchers [8, 9, 10, 11, 12, 13, 14]. In this method, in order to 
estimate the detection rates, the sender randomly chooses several kinds of states with 
different intensities. One is the signal states, from which, we generate the secret keys. 
Others are the decoy states, which are used for estimating the action of eavesdropper 
and have different intensity from the signal state. 

However, we cannot still realize a truly secure QKD system in the real world due 
to the finitcncss of the realized code length. Most of the above results assume the 
asymptotic setting except for Mayers [3]. Also, their privacy amplification requires many 
calculation times. Renner [15] proposed to use universal2 hash function for privacy 
amplification and showed the security under this kind of hash function. Universal2 hash 
function has been recognized as a fundamental tool for information theoretical security 
[16, 17, 18, 19]. His security proof is quite different from the traditional Shor-Preskill 
formalism because it employs the left over hashing lemma (privacy amplification) while 
the traditional Shor-Preskill formalism employs error correction. He proved security 
based on the On the other hand, in the context of the traditional Shor-Preskill formalism, 
it was shown that the leaked information can be evaluated only by the phase error 
probability [5, 20, 21, 22, 23], which imphes that the phase error correction guarantees 
the security. Using this fact, Tsurumaru-Hayashi [24] showed that the security under a 
wider class of hash function, which is called £-almost dual universal2 hash function. 

In order to treat the finiteness problem. In the single photon case, Hayashi treated 
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the second order analysis of the coding rate with Gaussian approximation by using the 
above phase error correction formahsm[5]. Indeed, recently, the second order analysis 
has been paid much attentions to among information theory community due to the 
relation with analysis of finite-length code [25, 26, 27, 28]. Scarani et al.[29] and Sano 
et al. [30] also treated this problem only for collective attack. Recently, using Renner's 
formalism, Tomamichel et al [31] derived an upper bound formula for security with 
the finite-length code. Using the phase error correction formalism, Hayashi-Tsurumaru 
[32] derived better upper bound formulas for security with the finite-length code, which 
attain the second order rate given in Hayashi [5] . They also treated the variable length 
type of the universal composability based on the phase error correction formalism. 
However, these results assume the single photon source. Furrer et al. [33] gave a finite- 
length analysis with continuous variable quantum key distribution, which works with 
weak coherent source. 

While continuous variable quantum key distribution can be implemented with a 
cheap Homodyne detection, the decoy method with BB84 protocol can achieve the 
longest distance with the current technology [34, 35]. Hence, employing the phase error 
correction formahsm, we treat the security of finite-length code of BB84 protocol when 
we use the weak coherent hght and the decoy method. Our finite-length evaluation can 
be divided into two parts. The first part is the estimation of the channel parameters and 
the source parameters. Indeed, all of the eavesdropper's action can be described by the 
channel parameters, which contains the detection rate and error rate for each number 
state. Hence, it is sufficient for the evaluation of the leaked information to estimate the 
channel parameters. Since the photon number of the source has a stochastic behavior, 
we have to treat the stochastic behavior of photon numbers in sources as well as that 
of the estimator of the channel parameter. The second part is the evaluation of the 
virtual decoding phase error probability under the assumption that the above parameters 
belong to a certain region. Combining two parts, depending on the intensities of signal 
and decoy pulses, we derive a sacrifice bit-length that guarantees that the universal 
composablity of the final keys is less than a certain threshold. As is illustrated in Fig. 
3, our calculation formula for a sacrifice bit-length employs only the basic formulas of 
the percentage points and the interval estimation of the binomial distribution, whose 
packages are available in several computer systems. Hence, it does not contain any 
optimization process, and then it requires a relatively smaller calculation time. Further, 
we numerically calculate the key generation rate per pulses in several cases. In these 
numerical calculations, since the required error probabilities are too small to calculate 
the exact percentage points and the exact interval estimation, we employ Chernoff 
bound, which is summarized in Appendix. Since the required error probabilities are too 
small, the difference between the exact value and the value based on Chernoff bound 
is sufficiently small. We also improve the asymptotic key generation rate when we mix 
the vacuum pulse and one decoy intensity pulse to the signal pulse. 

Our method has improvement even in the asymptotic setting because our 
parameterization is different from existing parameters in the following way. Existing 
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methods estimate the counting rates (yields) of the respective states (the vacuum state, 
the single photon state, etc.) and the probabilities that the photon is detected and the 
phase error occurs for the respective states as channel parameters. However, our method 
estimate the two kinds of probabilities, the probabilities that the photon is detected and 
the phase error occurs, and the probabilities that the photon is detected and the phase 
error does not occur, in the respective states. Our parametrization has the one-to- 
one correspondence with existing parametrization. However, as is shown in Subsection 
8.2, our parametrization yields a better asymptotic key generation rate than existing 
parametrization. Usually, the decoy method estimates the these parameters by using the 
constraint that these parameters are non-negative. The reason why our parameterization 
is better is that the non-negativity in our parameterization yields a more strict condition 
than that in existing parameterization. Hence, our parameterization provides a better 
key generation rate even in the asymptotic case. Further, in Subsection 8.2, we show that 
when the decoy intensity is infinitesimal, we can perfectly estimate these parameters for 
the single photon state in the asymptotic limit, i.e., when the length M of raw keys goes 
to infinity. Note that it is usually not impossible to perfectly estimate these parameters 
for the single photon state in the asymptotic limit while it is possible to perfectly 
estimate these parameters for the vacuum state in the asymptotic limit by using the 
vacuum decoy state. However, the convergence to the asymptotic key generation rate 
is not uniform when the decoy intensity is infinitesimal. That is, the convergence speed 
depends on the decoy intensity. Hence, it is needed to address the trade-off between 
the speed of the convergence and the asymptotic key generation rate. This trade-off 
is discussed by considering the second order asymptotics in Section 11. In Subsection 
13.1, we numerically check how well the approximation by the second order asymptotics 
works. 

This paper also addresses the case when the intensities are not fixed or are different 
from our intent. We treat the asymptotic key generation rate when the intensities are 
different from our intent in Subsection 8.3. We numerically demonstrate how error 
of our guess influences the asymptotic key generation error by considering the error 
rate of our guess of the intensities. In Subsection 12.1, we discuss our key generation 
rate with flnite-length when the intensities are not flxed and obey certain probability 
distributions. In Subsection 13.2, We numerically calculate the above key generation 
rate when the intensities obey Gaussian distributions. In Subsection 12.2, we discuss our 
key generation rate with finite- length when the intensities are different from our intent. 
More precisely, we consider the case when there are several candidates for distributions 
of the intensities. 

The organization of the remaining part is the following. As a preparation. Section 
2 reviews the result for the universal composablity of the final keys when we know the 
breakdown of the received pulses and the phase error probability among single photon 
pulses. Section 3 gives a concrete protocol of the decoy method. Section 4 explains 
how eavesdropper's action can be described. Section 5 summarizes a fundamental 
knowledge for random variables. Section 6 briefiy describes our security proof the outline 
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of the latter discussion. Section 7 gives the estimate of channel parameters when the 
breakdown of the generated sources is given. In Section 8, we apply the method given 
in Section 7 to the asymptotic case. In Subsection 8.2, we compare our asymptotic key 
generation rate with the existing rate. In Subsection 8.3, similar to [13, 14], we treat 
the asymptotic key generation rate when we cannot identity the true intensity perfectly. 
In Section 9, we treat stochastic fluctuation of the photon number of the sources. Then, 
combining the discussions in Sections 6, 7, and 9, we obtain the sacrifice bit-length 
guaranteeing the security. However, the obtained sacrifice bit-length can be improved 
by the way given in Section 10. In the improved method, we put out several probabilities 
from the square root. Since the improved method is too complicated, we give a looser 
evaluation, first. After describing whole structure, we give a better method. Indeed, 
when the decoy intensity is less than the signal intensity, the asymptotic key generation 
rate is best when the decoy intensity goes to zero. However, in the finite-length setting, 
the estimation does not work properly under the limit. In Section 11, we take the 
asymptotic expansion of sacrifice bit length up to the second order. Then, we optimize 
the decoy intensity in the sense of the second order coefficient. In Section 12, we treat 
the finite sacrifice bit-length when the source intensity is not fixed. In Section 13, we give 
the several numerical calculations with the finite-length setting. In Appendices A,B,and 
C, we summarize the basic knowledge concerning the tail probability and the interval 
estimation under the binary distribution. In Appendix D, we summarize calculations 
required for the numerical calculation in Section 13. 



2. Security evaluation 

An evaluation method to use the trace norm is known as a security criterion in QKD, 
which is often called the universal composability[36]. When the length m of the final 
keys is not fixed, we need a more careful treatment. We denote the final state and Eve's 
final state by pAE\m and pE\m, respectively when the length of the final keys is m. Our 
ideal Alice's state is the uniform distribution PiYiix\m '^^ ^ hits. 

Hence, the ideal composite state is Pmix\m ® PE\m- We denote the state indicating 
that the length of final keys is m, by \m){m\, and its probability by P{m). Then, 
the state of the composite system is pae '■— ® PAE\m, and its ideal 

state is P[(IqqI X^m '^mixim ® PE\m- Hence, the averaged universal 
composability of the obtained keys is written as the trace norm of the difference between 
the real state pae of the composite system and its ideal state Pidealt^"^!^ 

||PA,B-Pideallli (1) 
Hence, a smaller trace norm guarantees more secure final keys. 

On the other hand, when we apply surjective hash functions as the privacy 
amplification [21], [32, (10)] the above value is bounded by the averaged virtual phase 
error probability Pph as. 

||pA,E-Pideallli<2V2v^ (2) 
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Then, the security anlysis of QKD can be reduced to the evaluation of Pph- 

In the following, wc consider the protocol with the privacy amplification with the 
sacrifice bit length S over the raw key with length M. When the number of phase error 
among M bits-raw keys is E and we apply the minimum length decoding, the averaged 
virtual phase error probability Pph is evaluated as 

Pph < 2^^''('"'°(s'5))-^. (3) 

Hence, we can guarantee the security of the final keys when the sacrifice bit length S 
is sufficiently larger than M h{mm{^ , j)) . However, the number E of errors among 
raw keys docs not take a deterministic value, it obeys a probability distribution Q{E). 
Then, when wc apply the minimum length decoding, the averaged virtual phase error 
probability Pph is evaluated as 

E{Pph) < Q{E) niin(2^'^(''^^"(^'^))-^, 1). (4) 

E 

Next, we consider the case when the transmitted pulses generating the raw keys of 
M bits take the following three types. The first is the vacuum state, the second is the 
single-photon state, and the third one is the multi-photon state. In the following, we 
assume that the transmitted pulses generating the raw keys of M bits consist of J° bits 
pulses with the vacuum state, bits pulses with the single-photon state, and bits 
pulses with the multi- photon state. Due to the assumption, the relation M — J^+J^+J"^ 
holds. 

When we send the pulse with the vacuum state, no information can be leaked to 
Eve. That is, the leaked information to Eve equals to the leaked information to Eve 
when we send the pulse with the single-photon state and with phase error probability 
0. On the other hand, in the case of the multi-photon case, we have to consider that all 
information is leaked to Eve. Hence, the leaked information to Eve equals to the leaked 
information to Eve when we send the pulse with the single-photon state and with phase 
error probability 1/2. Therefore, when we denote the number of phase errors among 
bits, after we apply a proper class of hash functions in the privacy amplification J, the 
averaged virtual phase error probability Pph is evaluated as [21, (19)] and [24] § 

Pph < 2'^^''^'''''^-' (5) 

because J'^ — M — — J^, where we define 

0(J°, J\ J') := Ji/i(min(^, \)) + {M - j' - j'). (6) 
Due to (5), we can regard 0(J°, J^, J^) as a leaked information. 

I More precisely, when we apply e-almost dual universal2 hash functions, Pph is evaluated as Pph < 

£ ■ 2'^^'-' ''^ As is explained in [24], several practical hash functions, e.g., the concatenation of 

Tocplitz matrix and the identity matrix, arc 1-almost dual universal2. 

§ In the derivation [21, (19)], we consider that The qubits has the phase error rate min(j^, i) and 
The J^(= M - - J^) qubits has the phase error rate 1/2. 
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In the real case, the values J°, J^, and ,P do not take deterministic values, and 
obey the probability distribution Q{J^, J^, J^). Hence, the averaged virtual phase error 
probability Pph is evaluated by 

PpH< Yl Q(^°,^S^')min(2'^(^°'^^-^^)-^l). (7) 

In the general case, the size of sacrifice bit length S also does not take a deterministic 
value, and is stochastically determined. In such a case, the values J", J^, J^, and S 
obey a simultaneous distribution Q{J^ , J^, J"^, S), and the averaged virtual phase error 
probability Pph is evaluated by 

p,H< E Q(^^^^^^5)min(2^(^"'^^^^)-^l). (s) 

In the following, for a simplicity, we employ the notations J = (J", J^, J^) and 
0(J) :=0(AJ\J3). 



3. Decoy method 

In the following, we assume that the raw keys with M bits are generated by N bits pulse 
transmission with imperfect photon source. Now, we assume that there are A^'' pulses 
with the vacuum state and pulses with the single-photon state among TV transmitted 
pulses 

Then, using the detection probability ^ of the vacuum state transmission, the 
detection probability of the single-photon state transmission, and the probability 
b\ when we detect the pulse and the phase error occurs for the single-photon state 
transmission, the numbers J°, J^, and can be estimated as 

J° ~ NY, ~ N^q\ ~ N^b\ (9) 

However, it is not easy to estimate the breakdown. Now, we consider the case when 
the N weak coherent pulses with intensity /xi are transmitted. Then, we obtain the 
expansion concerning the photon-number states. 

oo „ 

y e-''i^|n)H =e-''i|0)(0|+e-''i/Xi|l)(l|+e-''i/x?a;2P2, (10) 

n=0 

where 

1 °° ii"'-'^ 1 
^^^=77EV|^>^^I' ^2:--,{e^^-{l + f^i)). (11) 

Then, the breakdown can be estimated as 

N'^ Ne-^\ N^^Ne-^^jii. (12) 

Hence, it is needed to estimate the parameters ^, q^, and h\. For this purpose, 
we shuffle coherent pulses with another intensity ^2- In the following, we assume that 
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III < fi2- This method is called the decoy method [7, 8, 9, 10, 11] ||D Indeed, the coherent 
pulse with another intensity 112 has the following expansion. 



J]e-'^^^|n)(n| = e'^^ |0)(0| + e-'^>2|l)(l| 

+ e~^^iiluj2P2 + e'^'^ nl{iJi2 - A*i)u;3P3, (13) 



n 

n=0 



where 



1 ,Ji-2 

^3 [1^2 - l^i)n\ 



P3 



3 

2 1 ,,2 



^3 := ile'^^ - (1 + /^2 + ^)) - ^2i^'' - (1 + /^i + ^)). (14) 

Using the difference between the two expansion coefficients, we can estimate the 
detection rates g° and ^. 

In the following, we give a detail of our protocol. 

(1) :Transmission Alice (the sender) sends the puses with the vacuum, the coherent 

puses with the intensity /Xi, and the coherent puses with the intensity /i2i randomly 
with a certain rate. Here, we choose the bit basis and the phase basis with the ratio 
1 — A : A among the coherent puses with the intensity /^i, and the coherent puses 
with the intensity 1121 

(2) :Detection Bob (the receiver) chooses the bit basis and the phase basis with the 

ratio 1 — A : A and measures the detected pulses. Then, he records existence or 
non-existence of the detection, his basis, and the measured bit. 

(3) : Verification of baisis Ahce sends Bob all information concerning the basis and 

the intensity for all pulses. Bob sends Ahce what pulses has the coincidence basis. 
Then, we denote the number of vacuum pulses, the number of pulses with the 

intensity jii and the phase basis in the both sides, and the number of pulses with the 
intensity 112 and the phase basis in the both sides, by Nq, Ni, and A''2, respectively. 
We also denote the number of pulses with the intensity /ii and the bit basis in the 
both sides and the number of pulses with the intensity H2 and the bit basis in the 
both sides, by and A^', respectively. See Fig. 1. 

(4) :Parameter estimation Alice and Bob announce all bit information concerning 

A"i + A'2 pulses with the phase basis in the both sides. Then, we denote the number 
of vacuum pulses detected by Bob by Mq. We also denote the number of coherent 
pulses detected by Bob with the intensity //j, the phase basis in the both sides, and 
the agreement bit (the disagreement bit) by Mi{Mi+2) for i = 1,2. (However, we 
will not use M4.) Further, we denote the number of coherent pulses detected by 
Bob with the intensity fii and the bit basis in the both sides and the number of 
coherent pulses detected by Bob with the intensity //i and the bit basis in the both 
sides by M and M', respectively. Sec Fig. 2. 

II In a wider sense, we can regard the check bits estimating the phase error probabiUty as another kind 
of decoy state. 
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In the following, we describe the key distillation protocol for M bits raw keys 
generated by the coherent pulses with intensity /Xi. The key distillation protocol for M' 
bits raw keys generated by the coherent pulses with intensity /i2 can be obtained N and 
M by N' and M', respectively. 

(5) :Error correction First, we choose a suitable M-bits classical code Ci that works 

for the expected bit error ratep+. We prepare a set {s'^g]}[a]e¥f /Ci representatives 
for decoding. We also prepare another a set {^[s]}[s]e¥^ /Ci '^^ representatives. 
Then, Alice and Bob exchange their information F^/C^. Alice obtains x 
s — s^g^in C2, and Bob obtains x' := s' — sj^^ — s^s'-s] ^i- 

(6) :Privacy amplification By using the method explained latter, we define 

the sacrifice bit length S in the privacy amplification from N,Nq,Ni,N2, 
M, Mq, Ml, M2, M3. Then, Alice and Bob apply e-almost dual universal2 hash 
function from Ci = to F2"'^[24]. Then, they obtain the final keys. 

(7) :Error verification Ahce and Bob apply a suitable hash function to the final 

keys. They exchange the exclusive OR between the above hash value and other 
prepared secret keys. If the above exclusive OR agrees, their keys agree with a high 
probability [38, 39]. 
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In the error correction, we lose more than Mh{p+) bits. When we lose r}Mh{p+) 
bits in the error correction, the final key length is M — r]Mh{p+) — S. Generally, we 
chose 77 to be 1.1. 
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4. Description of Eve 

In the following, we describe the strategy of Eve. For this purpose, we treat only the 
vacuum pulses and the pulses with coincidence basis, whose total number of pulses is 
No + N1 + N2 + N + N'. We do not treat other types of pulses. In this case. Eve cannot 
distinguish the intensities /ii and 112 perfectly. Alternatively, we assume that Eve can 
choose her strategy depending on the number of photons because she can distinguishes 
the number of photons. Then, Eve is assumed to distinguish the states |0)(0|, |1)(1|, P2, 
and P3. 

In the following, we assume the following: 

• There are pulses with the vacuum state and Nl pulses with the single-photon 
state among A^i pulses with the intensity Hi and the phase basis. 

• There are iVg pulses with the vacuum state, iVj pulses with the single-photon state, 
and N2 pulses with the state p2 among N2 pulses with the intensity 112 and the phase 
basis. 

• There are A^*^ pulses with the vacuum state and A^^ pulses with the single-photon 
state among A^ pulses with the intensity fii and the bit basis. 

• There are N^' pulses with the vacuum state, A^^' pulses with the single-photon 
state, and A^^' pulses with the state p2 among A^' pulses with the intensity /i2 and 
the bit basis. 

For a simplicity, we employ the notations N := (A^°,A^^), N' := {N^' , N^' , N'^'), 
iVi := {N^,Nl), N2 := (AT^, ATj, Ar|), and N := {N, N' , N^, N2). 

In the above breakdown, there are A-Q + + + A^o + m pulses with the vacuum 
state, Nl + N2 + N'^ + N^' pulses with the single-photon state, + A^| pulses with 
the state p2 and the phase basis, and A| pulses with the state pa and the phase basis, 
where := A^i - - Nl and A^| := N2 - N^ - N^ - N^. Note that the average state 
with the bit basis is not the same as the average state with the phase basis in the case 
of the multi-photon state. 

Then, Eve is assumed to control the detection rates in the Bob's side g^, (f , q\, and 
ql, among Aq + A^i + A^2 + A^° + A^°' vacuum pulses, A^^ + N^ + A^^ + A^^' single-photon 
pulses, A"^ -|- A| pulses of the state p2 with the phase basis, and A| pulses of the state 
Pa with the phase basis, respectively. Similarly, Eve is assumed to control the rates h\ , 
h\ , and h\, that Bob detects and phase error occurs among Nl -\- Nl -\- N'^ -\- N^' pulses, 
Nf + A| pulses, and N^ pulses, respectively. In the following discussion, we use the 
parameters := — b]^, ■— ?x ~ ^x) •= ^x ~ ^x; instead of q^, q'^, q^. For 
a simplicity, we employ the notations a := {al^,a^,a^) and b := (6x,6x!^x)- Eve is 
also assumed to control the parameters (f, a and h depending on the breakdown of the 
total Aq + A"! -|- A^2 + A^ + A^' pulses. Further, Eve is assumed to choose these values 
stochastically. Hence, the simultaneous distribution with condition for N can be written 
as Qe{(f iCi^blN). Hence, we have to analyze the security for respective breakdown of 
the total A"o + A^i + A'2 + A^ + A^' pulses. 
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5. Prepciration concerning behavior of random Vciriables 

First, we summarize fundamental knowledge concerning behavior of random variables. 
When the true distribution is the A^-trial binary distribution with success probabihty p, 
which is denoted by Bin{N,p), we also denote the upper percent point with probability 
a by Y'^{N,p, a), and denote the lower percent point with probability a by Y~{N,p, a). 
Then, we define p+(N,p,a) := Y+(N,p,a)/N, and p-(N,p,a) := Y-{N,p,a)/N. 
When we observe the value k subject to the binomial distribution Bin{N,p) with 
the trial N and probability p, we denote the lower confidence limit of the lower one- 
sided interval estimation with the confidential level 1 — a by p~{N, k, a). Similarly, we 
denote the upper confidence limit of the upper one-sided interval estimation with the 
confidential level 1 — a by p'^{N, k, a). Then, we define X~{N, k, a) := p~{N, k, a)N, 
and X+(iV, k, a) := p+(iV, k, a)N. 

Next, we study the stochastic behavior of the measured values M — 
(M, Mo, Ml, M2, M3) under the assumption that the parameters ^,a,h are unknown, 
but is fixed to certain values. The number of vacuum pulses is A^o + -^1 + -^2 ■ The 
detection ratio in Bob's side among A^o + -^i* + -^2 vacuum pulses is fixed. A^o vacuum 
pulses are randomly chosen from Nq + + vacuum pulses, and Mq is the number of 
detected pulses among these Nq vacuum pulses. Hence, the random variable Mq obeys 
the hypcrgcometric distribution. When R > (f, the probability Pr{^ > R} under the 
above hypergeometric distribution is smaller than that under the binomial distribution 
Bin{No, (f). This is because, if the detection rate among the initial L pulses is greater 
than R, the detecting probabihty of the L -\- 1-th pulse is less than ^ for L < A^o in the 
case of hypergeometric distribution. 

Thus, we obtain 

PW|,-o,^,5,iv{^o < Y-{N,, e)} < e (15) 
PrM,j|,o,^,5,iv{^o > Y+{No, e)} < e, (16) 

where Pr^y^ j^^q dh n distribution concerning the random variables M, J when 

(f, d, b, N are fixed. That is, we obtain 

PWk-.aAivl^o < X-(Aro,Mo,e)} < e (17) 

where Mq is the expectation of Mq, which equals g^A^o- 

Next, we focus on A^i pulses with intensity /Xi, which contain vacuum pulses, 
Nl pulses with the single-photon state, and A^^ pulses with the state p2- Assume that 
A^i = 0, |- < a^, and Mi is the expectation of Mi, which equals + al.Nl + al.Nf. 
The probability Pr{^ > R} for R > Mi/Ni is smaller than that when Mi obeys the 
binomial distribution Bin{Ni, Mi/Ni). This fact can be shown as follows. Assume 
that the detection rate among the initial L pulses is greater than R. Under the above 
condition, the ratio of the single-photon pulses among initial L pulses is higher than 
^ with probability more than 1/2. Conversely, under the above condition, the ratio 
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N 

of the single-photon pulses among remaining Ni — L pulses is smaller than with 
probability more than 1/2. Hence, the detecting probability of the L-|- 1-th pulse is less 
than Mi/Ni. Therefore, 

Ml 

P^m,jimnWi < Y-{N„ ^, 6)} < 6 (19) 



P^m,jiM,nW^ > ^^(^1' 1^' ^ ^' (20) 



Ml 

which implies that 

P^m,j\M,nW^ < X-iN^,M,,e)} < e (21) 
P^M,j\,o,^,h,NWo > X^{N„ Ml, e)} < 6. (22) 

Repeating a similar discussion, we can show the above relations without the condition 
= 0. 

Similarly, the expectations of M2 and M3 are calculated to ^-^2 + + ^x^^l + 

a^iVf and ^N^ + bl^Nl + b^N^, and are denoted by M2 and M3, respectively. Then, 
we obtain 

P^M,JW\a,B,NW2 < X-(iV2,M2,e)} < e (23) 
P^M,j\go,a,B,NW^ > X+{N„ M„ e)} < 6 (24) 
PWk-°,^Aiv{^3 < X-(iVi, Af„e)} < 6 (25) 

^^M,j\,^,a,h,NW^ > ^^(^1' ^^3, e)} < e. (26) 
For a detail discussion , see [40]. 



6. Outlines of derivation of sacrifice bit length and security proof 

In this section, we give the outlines of derivation of sacrifice bit length and its security 
proof while their details will be given in latter sections. In the following, we treat the 
case when the intensity of the signal pulse (the signal intensity) is /Xi and the intensity 
of the decoy pulse (the decoy intensity) is fi2- 

First, we fix the breakdown N of transmitted pulses. Then, wc will give the 
sacrifice bit length in the privacy amplification as a function of the measured values 
M = (M, Mo, Ml, M2, M3) and the breakdown N. For this purpose, we introduce two 

— * 

conditions for the breakdown N. 
Condition 1 

NlN^ - N^N^ > 

Condition 2 

NfN^ - N^Nl < 0. (28) 

Condition 3 

Ar2/vo - /V2 /V? /V? . . 



(27) 
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When the all values take their expectation, the left hand side of Condition 1 is 
ig-Mi-M2^_^^2(/i2 — fii)u2NiN2, and is positive. In the same assumption, the left hand 
side of Condition 2 is ^NiN2e~^^^~^'^^^ui2{iJ'l — /J-l), and is negative. 

Condition 3 is equivalent with 

The above condition is equivalent with 

2^ - ^ < Nl (31) 

Then, this condition is converted to 

M , , 

When the all values take their expectation, the left hand side is 2^e~'*2+/ii^ the 

2 

right hand side is + X^e'^"^^^^ . Then, the above condition holds. Hence, these three 



assumptions are natural 
We also e 

Condition 4 



We also assume a condition for the estimate a\ and h\ for and h\ as follows. 



6^ 1 

< i (33) 

Hence, in Section 7, for a given real number /3 > 0, we will give an upper 
bound of leaked information (l)2{M,N) as a function of N and measured values 
M = (M, Mo, Ml, M2, Ma) satisfying the following. 

P^m,j\,o,^,bM^2{M, N) < 0( J)} < 14 ■ 2-2^-«. (34) 

This equation implies the relations 

PrM,J|iv{<^2(M,iV)<0(J)} 

= 5^ ge(?°, a, 6|iV)Pr^^^|^-o_^_6,^{<^2(M, iV) < 0( J)} < 14 • 2''^-^ 

where Qe is the conditional distribution of q^, a, b with condition for the breakdowniV. 
Next, we define the set as the set of N satisfying 

e [Y{-{N, e-''\2-^^-^),Y+{N, e-^S 2-^/3-8)] (35) 

e [Y{-{N, //le-'^i, 2-2^-«), y+(7V, //ie-''S 2-2^^-^)] (36) 

e [yf (A^i, e-'^i, 2-'^-«), y+(Ari, e-'^i, 2-"^-^)] (37) 

A^i' e [yf (iVi,/xie-'^\2-2'^-«),y+(7Vi,/.ie-'^\2-^^-«)] (38) 

TVO e [yf (iV2, e-'^^ 2-2^-«), y+(7V2, 6-^^% 2-2^-^)] (39) 

^2 e [yf (iV2,/X2e-'^%2-2/^-8),F+(iV2,/X2e-'^%2-2'5-8)] (40) 

ATI G [yf (iV2,a;2/x^e-^^2-2^-«),y+(iV2,a;2/x^e-^^2-2^-^)]. (41) 
Then, we introduce the following condition. 
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Condition 5 

Ff (iVi, fHe-^\2-'^-')Y,-{N,, uj,f^le-^\2-^^-') 

> (iVi - Ff (iVi, e-^\2-^f'-') - Y,-{N,, ^,e->'\2-^^-^))Y+ {N2, ^126-"% 2-^^-^), 
Ff (iV2, co2file-''\2-^^-'')Y,-iNi, e-^S 2-2'3-«) 

> (iVi - Ff (iVi, e-'^S 2-2/^-8) - Ff (iVi, /xie-'^\ 2-2/'-8))F+(iV2, e-^^ 2-2/^-8), 

Ff (iV2,c^2y^^e"^^2-^^-^) Ff (iV2,e-^^2-^^-«) 

A^i - Ff (iVi, e-^i, 2-2/3-8) - Ff (iVi, /iie-A^i, 2-2/3-8) F+(A^i, e-^'S 2-2/3-8) 
2F+(iV2,/^2e-^^ 2-2/3-8) 

^ F-(7Vi,/^ie-^i, 2-2/3-8) ■ 

This condition is equivalent with the condition that any element iV G l^i satisfies 
Conditions 1, 2, and 3. 

Under this condition, in Section 9, we will give the value 04 (iW) as a function of 

— * 

the measured value M, which does not depend on the breakdown N. This value will 
be decided to satisfy the inequality 

{MM)<MM,N)}CQI. (42) 
Then, we can show the following theorem. 
Theorem 1 When Condition 5 holds, we obtain 

PrjMMM) < 0( J)} < 3 • 2-'^-\ (43) 
Proof. The above definition yields that 

Ptj^QI < 14 ■ 2-2^-^ 

Since 

{MM) < 0( J)} C {02(M, N) < 0( J)} U {MM) < MM, N)} 

c {MM, N) < 0( J)} uniG {{MM, N) < (f){J)} n n^) u ni, 

we have 

PrjMMM) < 0( J)} < Pr^^^ ,^({02(M, N) < 0( J)} n n,) + Fr^ j ^^n^ 

< 7 . 2-2/3-8 + 14 . 2-2^-8 < 24 • 2-"^-^ = 3 • 2'^^'^, 

which implies the desired argument. □ 
Therefore, when pa,e is the final state with the sacrifice bit length 

S{M) := MM) + 2/3 + 5, (44) 
(8) implies that 

Pph 

< 2^^^-^Fi{MM) +2/3 + 5 < 0( J) + 2/3 + 5}" + Fr{MM) + 2/3 + 5 < 0( J) + 2/3 + 5} 

_ 2-2/3-5 _|_ 2 _ 2-2/^-5 _ 2-2;3-3 
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Thus, the relation (2) imphes 

||pA,^-Pideallli<2V22(-'^"'^/^ = 2-/^. (45) 

When the signal intensity is 112 and the decoy intensity is /xi, the above arguments 
hold with modifying (142) and (143) in the following way. 

iV°' e [Y,-{N', 2-2^-8), r+(iV', 6-'^% 2-2^-8)] (46) 
N^' e [Ff(iV',/X2e-'^% 2-2/^-8), F+ (AT', ^2e"^^ 2-2/^-8)]. (47) 

In summary, since Theorem 1 requires Condition 5, we need to choose the parameters 
fii, fi2, N, Nq, Ni, and N2 so that Condition 5 holds. That is, we need to choose 
sufficiently large integers N, Nq, Ni, and N2. Otherwise, we cannot apply Theorem 1, 
i.e., we cannot guarantee the security. 

The latter sections give a derivation of the sacrifice bit length 5" as a function of 
Hi, ijL2: N, No, Ni, N2, and M. The derivation is summarized as Fig. 3. In order to 
apply interval estimation and percent point, we have to decide which upper or lower 
bound to be used in the respective steps.. These decisions will be treated based on 
derivatives for respective variables. Hence, the calculations of these derivatives are 
main issues in the latter sections. 



M 



percent 




N 



I 



Interval estinnation 



solving simultaneous 
inequalities 



percent point 



+margin 



Figure 3. Outline of our derivation of the sacrifice bit length S. M = 
(Mo, Ml, M2, M3) is the estimate of channel parameter M = (Mq, Mi, M2, M3) given 
in Subsection 7.2. 
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7. Derivation of upper bound 4>2 of leEiked information 

7.1. Case when the channel parameters are given 

First, we will derive an upper bound 02 of the leaked information (p when the channel 
parameters (f, al,, b], and the breakdown N of N pulses. 

For this purpose, we describe the leaked information as a function of J*^, J^, and 

4)^M -J"^ - J^(l - /i(min{r\ 1/2})). (48) 

That is, (f) is monotone decreasing concerning and J^, and monotone increasing 

concerning r^. Hence, due to the same reason as (15), the channel parameters a^, 
and b\ satisfy 

^^j\^,.,1,n{J' ^ ^"(^°' 'f^ 2-'^-«)} < 2-^-« (49) 

^'^j\^,-a,h,N{J" ^ ^~(^'' «x + < 2-^^-^ (50) 
Using this fact, we give estimates of J° and as 

jO(gO,ArO) :=y-(iV°,gO,2-2'5-8) (51) 

j\al,bl,N') ■.= Y-{N\al+bl,2-'^-'). (52) 

Since p+(jS4 +&x>2"^^"^) < P+(j\ax +6x>2"^^"*) holds for > j\ (50) implies 
that 

PrJ|.-o,a,6,A^{P^(^^ «x + 2-^^-^) > p^{J\-al + bl,N'), a], + bl,2-'^-')} 
- P^Jl^,a,B,NU' < Y-iN\a\ + b\,2-^^-^)} < 2-^^-\ 
Using the relation 

Pr.|,o,.,6,Ar{^ >Pn^Sa!< +^^x,2-^'^-«)} < 2-^^-^ (53) 

we obtain 



C ({p+(j\4 +^!<,2-'^-^) >P+(J^(4 +&x,A^'),ax +&x,2-^^-«)} 
U{^-^,>P^{J\al+bl,2-^^-')}) 

C { < r-(Ar\ a\ + P,, 2-2/^-S)} U {j^ > p+( J\ ~a\ + 6^,, 2-2/^-^)}. (54) 

Therefore, we give an estimate of := j?- by 

f^(4,P„iV^) ■.^p^{j\a\+b\,N'),^^,2-'^-% (55) 

Using the above relations, we give an estimate of by 
0i(Ar,g°,4,6^J :=M- J°(g^iV°)- ji(4,6^,,iVi)(l-Mmin{f;,(4,6i,,iVi),l/2})). 

(56) 
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Due to (49), (50), (54), and (53), the estimate satisfies 

{<l>(J)>MN,f,al,bi)} 
C ({ J° < y-(iVO, cf, 2-2/5-S)} U { < Y-{N\ 4 , bi , 2-2'5-8)} 

U{^>p-(i^(4,^^.,^^),^,2--«)}) 

C ({ J° < r-(7V0, g«, 2-2/3-8)} u { < F-(7VS a^^, 6^^, 2-2/^-8)} 

Hence, we obtain 

Pr{(/>(J) > 0i(Ar,5-«,4,&x)} < 3.2-2^-«. (58) 
7.2. Estimation of channel parameters ^ , q^, and f]^ 

Next, in order to treat an upper bound of leaked information 0, we will give estimates of 
channel parameters q^,q^, and based on the measured values M and the breakdown 
N of pulses. For this purpose, we treat the dependence of the leaked information 

(j)i{N, (f, a\,,h\,, 2^'^l^^^)) concerning the channel parameters g^, a^, and b\. That is, we 
evaluate the partial derivative of (j)i{N . (f , a\.b\.) concerning (f.a\. and b\. 

However, while the partial derivatives of J^{q^,N^), (a], ,bl, , N^) , and 
fl,{al,,bl,,N^) arc needed, their calculations arc not easy. When A^'^ and A^"*^ are 

sufficiently large, these values take the same values as q^N^, {a\ + 6^)A^^, and ^r-^r, 

and the variations due to the fluctuations of (f, a^, and bl, are negligible. 

Hence, we can regard the derivatives of J^{q'^,N^), (a], ,bl, , N^) , and 

f^(ax, 6x, A^^) as the same as those of q^N^, (a^ + bl.)N^, and -i . Thus, we obtain 



dJ\ai,bi,N') ^ ^^ dJ\ai,bi,m) ^ 

da\. ' db\ 

dfi{ai;bi,N^) bi dfi{ai,bi,N') 



dai {ai+bif' dbi {ai + Kr 

Under this assumption, we have 



(59) 
(60) 
(61) 





ai,bi) 


d(j) 


d(f 








ai,bi) 


d(t) d,P 






(9J1 dai 




ai,bi) 


d(i) dp 


dbi 




aji dbi 



= -N^ < (62) 
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because ^t^^t- < |- Therefore, smaller 5° and yield larger 0i, and larger b\ yields 

larger 0i. That is, it is needed to estimate and to be smaller and 6^ to be larger. 

In the following, we treat the estimation of g^, a^, and b]^. Here, we should remark 
that we have two kinds of channel parameters. The first kind of parameters are g^, a^, 
and b\ , which are directly linked to the eavesdropping and cannot be measured directly. 
The other kind of parameters are the detection rate pi^x and p2,x of pulses of the phase 
basis with intensities /ii and fi2, which can be measured directly. Similarly, as other 
latter kind of parameters, we have the rates Si^x and S2,x that Bob detects and the 
error occurs of the phase basis with intensities /ii and 1^2, which also can be measured 
directly. 

The expectations Mq, Mi, M2, and M3 of Mq, Mi, M2, and M3 have 
characterizations Mq = Po-^o, Mi — (pi^x — si.x)-^!, M2 — {p2,x — S2,x)N2, and 
M3 = Si^x-^i- Hence, we can regard Mq, Mi, M2, and M3 as the second kind of 
channel parameters. In our setting, Mq, Mi, M2, and M^aie easier to treat than Pq, 
Pi,xi P2,x, Si,X) and S2,x- Thus, in the following, we estimate an upper bound of the 
leaked information via the estimation of the channel parameters g^, a^, and b]^ when 
the channel parameters M := (Mq, Mi, M2, M3) and the breakdown N of pulses are 
given. Then, using the expansion formula (13), we obtain 

Mo = fNo (65) 

(66) 



(f 



Ml = + alNl + alNl 



Mo 



which implies the matrix equation 



/ Mo 

Ml 

Y M2--a\Nl 



\ 



I 



i No 

Nl/2 











(67) 



(68) 



V«x / 



Solving the above, we obtain 



q\Mo 



Mo 



ai{M,N) 



Nl{Mi - MoN^/2No) - N^{M2 - MoN°/2No) 



NfNl 



NlNl - N^Nl ■ 

Since Ai and a\ are non-negative, we obtain a lower bound of a\ . 
a\ > a\M,N). 
Similarly, we have 

M3 = + biNl + blN^ 



(69) 
(70) 
(71) 

(72) 

(73) 
(74) 
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Since 5| is non-negative, we obtain an upper bound of 5^ as 

M Mo. 7V-0 

b\<b\{M,N):^ j^^. (75) 

Then, we can define an upper bound of as 

03(M(M),iV) :=MN,q'iMo),aUM{M),N);bl,iMiM),N)), (76) 

where M{M) is the estimate of M when M is observed. 

Indeed, when = d\{M,N) and b\ = b]^{M , N), the relations 

M,-^N'i+alNl + alN^ (77) 

M2 = ^A^2° + 4A^2+«xA^I (78) 
^3 = ^iV° + 6^,Ar^ (79) 

hold. 

Remcirk 1 When we extend the existing methodflO, 8, 11] to our finite length setting, 
we obtain the following evaluation. In this case, we employ the parameter instead of 
a\. Because smaller yields larger (f)i, similar to a]^, q^ can be estimated as 

.i.^v^. . N|{M^ + Ma - MqN^/Nq) - N^jM^ + M4 - MoN'2/No) 
^ NINI - N^N! ■ 

Then, in the upper bound <j)\ of the sacrifice bit size, a\ + b\ is replaced by q^{M, N). 
That is, we obtain an upper bound 

MN, g°(Mo), q\M, N) - bi (M, N), b\ (M, iV)), (81) 

which is larger than 4>3{M{M), N) because q^{M, N) - b\{M, N) < dl{M, N). 

7.3. Estimation of another kind of channel parameters M 

In this subsection, we treat the estimation of the channel parameters M that is required 
to estimate the channel parameters (f , a\, and b\ when the breakdown N = (N, Ni, 
N2) of pulses are known. That is, we consider the method to estimate Mq, Mi, M2, 
and M3 from the measured value Mq, Mi, M2, and M3. 

The partial derivatives of q°(Mo), d]^{M, N), and bl^{M,N) are calculated to 

1 

^ > (82) 



aMo A^o 



0, (83) 

(84) 



dMi dM2 aMs dM4 
dd\ _ (NfN^-N^N^) 
dM~o ~ 2No{NlNi - N^Nf) 
daj _ 
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dhl 



Nf 



= 0, 



dMo 2NoNl 



< 



dbi 



> 



dbl 



=0. 



Hence, applying Conditions 1 and 2 to (84), (85), (86), we obtain 

da], da\ da\ 

— =^ < — =^ > — =^ < 

dMo ' dMr ' dM2 

Thus, due to (62), (63), (64), and Conditions 3 and 4, we obtain 



<0, 



' >0, |^>0, 



^0 iVi(7V2iVO - iV|iVO)(l + log ^) N^Nlil + log ^ 



No 



+ 



27VoA^i' 



No 2No(NlNl - NfN^) ~ NqN} 



< 0. 



Hence, we need to estimate Mq and Mi to be smaller, and M2 and M3 to be large 
In the following, we employ 

:=X-(iVo, Mo, 2-2/^-8), 
:=X-(7Vi,Mi,2-2/^-«), 
:=X+(Ar2,M2,2-2/'-«), 
:=X+(7Vi,M3,2-2^-«), 
as estimates of Mq, -^1, -^2, and M3. That is, defining 

02(M,iV):=03(M(M),iV), 
we obtain the following theorem. 

Theorem 2 When the breakdown N satifies Conditions 1 and 2, the relation 



Mo (Mo) 
Ml (Ml) 

M2(M2) 
M3(M3) 



Pr 



^tf2(M,iV)<0(J)}<7.2-2/3-« 



J,M\^,a,b,N 

holds. 

Proof. The definition of 03 given in (76) yields 

{0( J) > 02(M, N)} C {0( J) > 03(M, iV)} U {03(M, iV) > 02(M, iV)} 
C {0( J) > 0i(Ar, 4, FJ} U {03(M, iV) > 02(M, iV)}. 
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Hence, the above calculation concerning the partial derivatives and Conditions 1 and 2 
imply 

{4>s{M,N)>MM,N)} 
C {Mo < Mo(Mo)} U {Ml < Mi(Mi)} U {M2 > M2(M2)} U {M3 > M3(M3)}. 
Thus, it follows from the relations (17), (21), (24), and (26), that 

P^j,m|,-o,.,m{<^3(M, N) > MM, iV)} < 4 • 2-'^-'. 
Using (95) and (58), we obtain 

Pr^,M|,-o,a,6,iv{<^2(M, N) < 0( J)} < 3 • 2-'^-' + 4 • 2-'^-' < 7 ■ 2-'^-\ 

□ 



8. Asymptotic analysis 

8.1. Asymptotic key generation formulas 

— * 

In this section, we consider the asymptotic setting. Then, we assume that all of N 
equals their expectations. The channel parameters po, Pi,x, P2,x, si,x, and S2,x satisfy 

a], =min{a^(pi,x -si,x,P2,x - S2,x, A«i, A*2), 0} (96) 
bi =6^Jsi,x,/^i), (97) 
where 

1 _ , _ a;2(/xie-^^(pi -poe-^V2) - /xfe-^^(p2 - Poe-^V2)) 

uj2e w ''2^iAt2(A*2 - pii) 
Atie'^i(pi -poe-'^VS) - /x?e'^2(p2 - Poe-'^VS) 



1^11^2(1^2 - 1^1) 

sie^' - Po/2 



Hi 

When the signal intensity is Hi, the key generation rate per a raw key is 

Similarly, when the signal intensity is 112, the key generation rate per a raw key is 

M - - MrjhifJ /^2e-'^^(ai + bi){l - H^)) + e'^^^po - P2,xVh{^) 
M ~ ■ 

Hence, the key generation rates per pulse with the coincidence basis are 

i?i := /.le-'^HSx + ^x)(l - + e-^'Po - Pi,xVhC-^) (98) 

at+bl Pi.- 



"X I "X 



X 



i?2 := l^2e-''%al + b\){l - h{-^)) + e'^^po - P2,xVh{'-^), (99) 

at + bl P2,x 
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which is the same as the apphcation of the GLLP formula [6] . On the other hand, the 
existing method[10, 9, 11] yields the key generation rates per pulse with the coincidence 
basis as 

^1 :^,,,e-''^\l-h{^))+e-^^Po-pi,^vh{^) (100) 

Q Pi,x 

R2 := f^2e-^'q\l - h{%)) + e'^'^po - P2,xVK^). (101) 

Q P2,x 

with 

.1 ^2(/^ie-^^(pi,x -Poe-^^) -/x^e-^i(p2,x - Poe'''')) .^q^) 

^ /^2e^'(Pi,x -Poe-^i) -/iie^^(p2,x -poe"^^) ^^^^^ 
HiH2{l^2 - f^i) 

8.2. Case when true intensities coincide with our intents 

In the following, we consider the case with no eavesdropper, i.e., the case when the true 
intensities coincide with our intent intensities. That is, we adopt the following model 
with parameters a and s: 

ax = 1 - e-"''^ +po, s,,x - s{l - e-^^^) + ^, (104) 
which implies x ~ Si.x = (1 ~ •s)(l ~ e~"^') + Hence, the relations 

a\ = a^(/ii,/i2) 

_ //ie''i((l - s)(l - e""'^!) + f (1 - e-'^i)) - //^e/^^^i _ _ g-a/.^) + _ g-Ma)) 

^1^2(^(2 - /Wl) 

(l-s+po/2)e'^i-(l-s)e(i-°''^i-^ (l-s+po/2)e^2 -(l-s)e(i-<^)A'2 

= (/X2/X1) ~ (105) 

[I2 - AH 

^x=&x(/^i):= ^ (106) 

= g^(/ii,/i2) 

/xie'^i((l - e-"^i) +po(l - e"^')) - /^?e^'((l - e""'"') +Po(l - e"''')) 

A*iAi2(Ai2 - A*i) 

= {^i2^il) (107) 

^^2 — /j'l 

hold. Substituting the above a^, 6^ into (98), (99), we obtain Ri and R2 as functions of 
//i and 112 in the following way: 

i?i(/.i,/.2) := /xie-^- (a!, (/.i, /.2) + &!< (/^i, /^2))(1 - /^( ^ f^') -)) 

ax(/^l,/^2) + 0x(/^l,/^2) 

+ e->o-pi,xr7M^) (108) 

Pl,x 
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+ e-'''po-p2,>cVK'^), (109) 

P2,x 

As is calculated in Figure 4, our key generation rate R2 improves the existing key 
generation rate i?2- 




Then, using (106) and the first equations of (105) and (107), we obtain 
lim ax(Aii,/i2) = (1 - s)a + ^, lim 6^ (/"i) = ■5" + tT' 1™ g^(/ii, /i2) = a + Po- 



Further, the both relations in (105), and the derivative of - — j^r- 



(l+po)e''i -e(i-°)''l -po 

concerning /xi imply 
«x(/^i) := lim «x(/^b/^2) 

At2-s-/ii+0 

(l-s+po/2)e'"i-(l-s)e(l-")'"i-po/2 (l-s+po/2)ef 2 _(l_s)e(i-«)''2 _po/2 

^5 — ^ 

2 r Ml M2 

= /i^ lim 



;i - s + Po/2)e'^i - (1 - s)e(i-")'^i - po/2 



(1 - s + po/2)e'^i + (1 - s)(l - a)e(^-")^i 



(2 - /ii)(l - s + po/2) - (1 - g)(2 - (1 - a)/ii)e-"^i - ppe-^^ 

(l+po)e^i -e(^-°)'"i -po _ (l+po)e^'2 -e(^-")^'2 -pp 



g^(/ii) := lim g^(/ii, /X2) = /i? lim 



~!5 — T" 

Ml M2 
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= ,(l+P.)e»-e'-»'--po _ ^ ^ _ 

Hi 

^ (2 - +po) - (2 - (1 - a)/xi)e-"^i - 2poe-^i 

Then, we obtain the following theorem. 

Theorem 3 (a^(/ii,//2) + ^x(a*i, A*2))(l ~ h{Tri—^^~T~W7 0) monotone decreasing 

/br iti and 112 when , ^xC^i'^a) ^ ^ ^ ^ 

Now, we fixed a signal intensity to be Hs- Then, Theorem 3 implies 
-R2(Afl,A*s) > -R2(Ai2,A*s) > -Ri(a*s,A*3) > -Ri(a*s,A*4) 

for III < 112 < IJ's < fJ'3 < fJ'4:- These inequalities imply that a smaller decoy intensity has 
a better key generation rate when the signal intensity is fixed. 
Further, using Theorem 3, we obtain 

sup {ai{i,i,i,2) + b'M){l-h{ ^ ^''^^'^^w ^ )) 

Mi:0<AH<M2 Ox [Hi, 112) + Ox [Hi) 

^ hni (aU/^1,/^2) + bliHiW - J ) 

= (a+po)(l-M^^)), (110) 
sup (a^x(/^i,/^2) + ^x(/^i))(l - ^(777 — M^^^TT^^)) 

|U2:0<Ml<M2 (//l, )U2) + Ox (A'iJ 



hm (aU/^1,/^2) + &U/^i))(l - MtTT-^^V^W^)) 
-^^1+0 aU//i,//2) + &M/^i) 



M2->-;i 

= {al{Hi)+bl{Him - ^Y^'l )). (Ill) 

Oxi/^l) +Ox(/^l) 

The right hand side of (110) equals the true parameter in the model (104). That is, 

when the signal pulse has the larger intensity 112 and we take the limit /ii ~^ 0, our 

^1 

value (110) coincides with the value (a^ + ^'x)^( m~^) with = y + oi{l — s) and 

— ^ + Note that the true parameters and 6^ are y + a{l — s) and ^ + <^s- 
These relations (110) and (111) imply the optimal key generation rate with a fixed 
signal intensity as (113) and (112). In particular, the case given in (110) yields the 
rate when we can perfectly estimate the parameters and 6^ as in (113). That is, 
the optimal rate coincides with the rate when the estimates d]^ and b\ are the true 
parameters ^x = ^ + «(! — s) and ^x = ^ + 

Ri{Hi) sup Ri{Hi,fJ'2) 

^l2■0<f^l<^^2 

= Hie-^^ id], (Hi) + di {Hi)){l - hi .i.fff^'l.. )) + 
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s(l - e""^i) + 20 

- (1 - e-- +Po)vh{ \_^_J^^^^ ), (112) 
-R2(a*2) := sup -R2(A*1,A*2) 

/Ui:0</ii<;i2 

= /.2e-^^(a +po)(l - h{^^)) + e-^'^po - (1 - e""'^^ + Po)vh{^, — ^^^|13) 

In particular, when po — 0, we obtain 

R2{l^2) = A*2e-'^^Q;(1 - h{s)) - (1 - e-"'^^)r7/i(s). 

Proof. Define the function /(a, b) := (a + 6)(1 — Since 



^ = l + log^-, ^ = l + log- 



da a + db a + 6 ' 

it is sufficient to show that (/xi, /i,2) is monotone decreasing for /xi and and 6x(Aii) 
is monotone increasing for /xi. 
Since 

s(eMi _ e(i-")w) + po(e''^ - l)/2 



00 n— 1 

- ^« + y + - (1 - + y ) V' (114) 

z 2 n\ 

n=2 

and s(l — (1 — a)'*) + ^ — 0' (a*i) monotone increasing for /xi. 
Further, 

(l-s+po/2)eW-(l-s)e(i-")^i-po/2 _ (l-s+Po/2)e''2 -(l-s)e(i-°)^2 -po/2 
a\{ni,H2) = (Ai2/^l) 

spoo (l-s+po/2)Mr''-(l-^)(l-«)"Ml"^ _ y^oo (l-s+po/2)Mr''-(l-^)(l-«)"Mr^ 

= (//2//l)^^^^^i ^ 

/i2 - /ii 

, ^ (1 - s +P0/2 - (1 - s)(l - a)")(K"^ - A^r^) 

— (,/^2/^ij 2. r? ^ 

n=3 m=0 

■^^ — ' n! ^ — ' 

n=3 m=0 

Here, (^^''^'^^^^-'-^"^ )+«)/2 ai-^ayg positive. Hence, a^(/xi,/X2) is monotone decreasing 
for Hi and /i.2. □ 
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8.3. Case when true intensities are different from our intents 

Next, we consider the case when we cannot perfectly identify the true intensities /ii and 
Ii2- That is, we know that the true intensities /ii and 112 belong to certain intervals 
[(1 — e)jli, (1 + ejfti] and [(1 — e)/i2, (1 + e)/i2] with an constant e > 0, respectively. A 
similar analysis has been done by Wang et al.[13, 14]. However, our analysis based on 
the asymptotic key generation rate different from theirs. 

In this case, we have to consider the worst case concerning the true intensities 
and /i2 in the intervals [(1 — e)/ii, (l + e)/ii] and [(1 — e)/i2, (l + e)/i2], respectively. Indeed, 
the smaller intensity pulse is generated by the combination of the stronger pulse and 
beam splitter. If the beam sphtter is well installed, the error only comes from the error 
of the stronger pulse source. In this assumption, the error ratio e does not depend on the 
intensity. Hence, when we observe the rates pi,x, P2,x, si,x, and S2,x, the key generation 
rates per pulse with the coincidence basis are 

:= min^,^e-^^{al + bl)il - h{-^)) + e'^o - Pi,xr?/i(^) 

Ox + Pl,x 
-R2(Pl,x,P2,x,Sl,x,S2,x,/il, A2) 

:= mmi,2e-^-{a\ + b\){l - h{-^)) + e'^o - P2,xr?/i(^), 

Ox + P2,x 

where the above minimums are taken with a\ = minja^ {pi.x — Si x , P2,x — "S2,x , A*i, A*2), 0} 
and Sx = 6x ("Si,x , yUi) under the constraint /xi G [(1 — e)/ii, (l + e)/ii],/i2 G [(l~e)/i2, (1 + 
e)fl2\- 

Now, we treat the typical case when true intensities are jli and fl2 and there is no 
eavesdropper. Then, the observed rates pi^x and s^^x are given by the true intensities fti 
and /t2 in the following way. 

p,,x = 1 - e-"^* +po, Si,x = s(l - e-"^0 + f , (115) 

which implies Pi^x—Si^x = (1 ~ "S) (1 — e~"'^' ) + order to analyze the key generation 

rates per pulse, we introduce additional notations. 



b 



1 



Riil^i, 1^2, h, 1^2) :=/^ie ^'{d\+b\){l-h{—^^^^)) + e ^^Po - Pi,xVh{ — 

at + bl Pi, 



X 



.S2,x 



R2(l^i, 1^2, h, 1^2) l^2e ^^(d\+b\)(l-h{ )) + e ^^Po - P2,xVh{ 

ax + Ox ^'2,x 

where a], = min{aix((l - s)(l - e""'^!) + ^, (1 - s)(l - e'"^^) + f,fii,fi2),0} and 
6x = b]^{s{l — e~"'^^) + Y, Hi). In this case, the key generation rates per pulse are given 
by 

Mie[(l-e)//i,(l+e)/ii],/U2e[(l-e)//2,(l+e)M2] 

R2{P'i, 1^2) ■= min RiilJ'i, fJ'2, h, ij'2) 

/iie[(l-e)/ii,(l+e)Ai],M2e[(l-e)/i2,(l+e)/i2l 
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Indeed, it is quite difficult to find the values fii G [(1 — e)/ii, (1 + e)/ii],//2 £ 
[(1 — e)jl2, (1 + e)/i2] realizing the minimums Ri{iii,ji2) and i?2(/ii, /^2)- However, our 
numerical demonstration suggests that = (1 + e)/ii and ^2 = (1 — e)/Lt2 give the 
minimums when e > is sufiiciently small and (1 + e)/ii < (1 — e)/i2- Indeed, as is 
shown in Theorem 4, /^i = (1 + e)/ii gives the minimum i?2(/ii,/i2) under the limit 
fli 0. 

Theorem 4 When a fixed intensity ji2 satisfies that 

H^ + e)<l ^ J^-IT' (116) 

(Tfi+Po)(l-M^^^) 

we obtain 

sup R2{fj'l, ij'2) = lim R2{fj'l, ij'2) 
fii:0<fii<p,2 

^ u ^ , ii™^,^2((l + e)/ii,A^2,Afi,/i2) 

M2e[(l-e)/i2,(l+e)M2] Mi^>0 

„ g I po 

= (1 + e)jl2e-^'^^y^\-^ +po)(l - M ' )) + e-(^+^)>o -P2,xr7M^;, 

where p2,x and S2,x '^'^e g'wen m (115). 

For a proof of this theorem, wc prepare the following lemmas. 

Lemma 1 When a}^^ = a.]. ((1 - s){l - e''^'^^) + ^, (1 - s)(l - e'"''^^) + f , //i, ^2) and 
h\ = 6x(s(l — e~"^^) + Yi/^i); Q-x ^■^ monotone increasing concerning jli and monotone 
decreasing concerning jl2, and tt^W is monotone decreasing concerning jli. Further, 

"x+^x 

(a^ — fe( .1 )) is monotone increasing concerning jli and monotone decreasing 

concerning 1x2 ■ 

Proof. The desired properties for a\ follow from the fact that (1 — — e~°'**) is 
monotone increasing concerning hi. Next, we consider -r-^. Since 

^1 ^ /^2(/^2 - /xi)e^i5(l - e-"^0 + ^2(;^2 - )m)e^ni - e~^^)Po/2 
we have 

^x ^ /X2e^i (/X2 - - e-"^0 + /i2(/^2 - /^i)e^^ (1 - e-^Opo/2 

+ hi /^2e^i (/i2 - /iis) (1 - e-°^i ) + /i2e^i (1 - e'^i ) (/X2 - Ati/2)po - 

S2(l-e-"'^i) + ^3 



S4(l-e-"w) + S5' 



where 




5i 


= /x?e^^((l-.)(l-e 




^2 


= /i2e''H/^2 - 




^3 


= /^2(/^2 - ywOe^ni - 




^4 


= ^i2e^^{fi2 - /iis) 






= /.2e'^ni-e'''')(/^2 


- Aii/2)po - 5i- 
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Since s < ^, we have 7 — - — r < th — - — ttvt, which imphes 

B2 _ /i2e''^(/i2 - _ s(/i2 - Ml) _^ fJ'2- fJ'l 



B4 //2e''i(//2 - Atls) (Ai2 - /xis) 2(id2 - ldi/2) 

^ /X2(/i2-/ii)e^^(l-e-^Opo/2 ^ /X2(/^2-/xi)e^Hl-e"^OPo/2 _ ^3 
/X2e«(l-e-w)(;x2-//i/2)po /X2e'^i(l-e-w)(//2-Aii/2)po-5i Sg' 
Since 1 — e~°'^^ is monotone increasing concerning fli, sl^(\Zl-ah)+Bl monotone 
decreasing concerning jli. Then, we obtain the desired argument for ty^tt- 

Finally, we use the function /(a, b) defined in the proof of Theorem 3. Since /(a, b) 
is monotone increasing concerning a and monotone decreasing concerning b, we obtain 

the desired argument for (a^ + b\){l — h{ .^^^^ ))■ □ 

Lemma 2 When /i2 > (1 + e)~V2; 

sup a],{{l -s){l- e-(^+^)-Vi) + ^, (1 - s){l - e""'^^) + ^, 

= hm. ai^((l - s){l - e-«a+^)-Vi) + ^, (1 _ ,)(i _ e-A.) + ^-^^j,,^,,,) 

= + 6)-^ + !, (117) 

sup 6i^(,(l-e-"(^+^)-Vi) + ^,/.i) 

0<M1 ^ 

= lim 6^.(1 - e-«M-Vi) + ^^^^) ^ ,^(1 + + ^. (118) 

Mi^+O z z 

Proof. Since ^xl-^ll ~ e^"*^^"*"*^^ ^^^) + is monotone decreasing concerning 

/^i, we obtain (118). Similarly, it is sufficient for (117) to show that a\{{l — s)(l — 
g-a(i+e) Vi) _|_ (X _ g)(x _ e~"'^2^ _|_ Ei^ ^2) is monotone decreasing concerning jii. 
Choosing 5 := q;(1 + e)~^, we obtain 



4((1 - s){l - e-«(i+^)-Vi) + |, (1 - s){l - e---^-) + |,/ii,/i2) 



|,(l-s)(l-e-'^^) + |, 

ii\e^^{{\ - s)(l - e""/^!) + po(l - e-^i)/2) - Ai?e'^2((l - s)(l - e-"'^^) + ^^^(1 _ e-/^2)/2) 

AH/^2(/^2 - ah) 

/xie'^i((l - s)(l - e-"'^^ +po(l - e-'^i)/2) - \x\e^^{i\ - s)(l - e'^^^) +po(l - e-'^2)/2) 

IJ'llJ'2{lJ'2 - A*l) 



1 _ _ (1 _ + V2,^ . ™+l ,n-2-„», 

n=3 m=0 



A*2(A«2 - A^l) 

00 / 

^Po/2+{l-s)a-J2- \^ (E^i 

n=3 
/^2(/^2-/^l) 

Since e""''^ — e""'*^ > 0, the final term is monotone decreasing concerning fj,i. Other 
terms are also monotone decreasing concerning //i. □ 

Proof of Theorem 4. 
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For a fixed 1I2 and 112 satisfying (1 — e)/i2 < A*2 < (1 + e)/i2, Lemmas 1 and 2 imply 
sup min ^2(a«i, A*2, /ii, /i2) 

:0<^-i< Ml e[(l-e)/ii ,(l+e)/ii] 

= sup min R2{fJ'i, fJ'2, P'2) 

= sup ^2(ah, A(2, (1 + e)"Vi,/i2) 

Mi:0<Ati<At2 

= lim ^2(a*i,A*2, (l + e)"Vi,/i2)- (119) 

/ii-*-+0 

Hence, we obtain 

sup min R2{lJ^i, IJ'2, h, h) 

fXl-.OKiXiKiXi /iie[(l-e)/ii,(l+e)/ii] 
^ -^^^.n u ^ ,^2(1^1, 1^2, h,h) (120) 

= lim ^2((1 + e)/ii,A*2,/ii,A2)- 

Since the convergence (119) is uniform concerning /X2 and jl2, the convergence (120) is 
uniform concerning 1^2 and fl2- Hence, we obtain 

min lim min -R2(/^i, A*2, /ii, /i2) 

/U2e[(l-e)A2,(l+e)A2] Mi->-+0 //iG[{l-e)(ai,(l+e)/ii] 

= lim min min -R2(/^i, /^2, Ati, /i2)- (121) 

On the other hand, 

min lim min -R2(/^i, /^2, /ii, /i2) 

M2e[(l-e)/i2,(l+<:)/i2] /iie[(l-e)/Ii,(l+e)Ai] 

= min sup min -R2(a*i, /^2, /ii, /i2) 

;i2e[(l-e)A2,(l+e)M2] ^~j.o<jui<i=Sjtr2 A'ie[(l-€)/ii,(l+e)/ii] 

> sup min min -R2(/^i, A*2, /^i, /i2) 

/ri:0<Mi< jq^M2 M2e[(l-e)A2,(l+e)A2] MiG[(l-e)Al,(l+c)Ai] 

> lim min min -R2(a*i, A*2, /i2)- (122) 

Mi-)-+0 |U2e[(l-e)/i2,(l+e)/i2] /iie[(l-e)/ii,(l+e)/ii] 

Combining (121) and (122), we obtain 

sup min min R2{l^i, 1^2, i^i, fi-2) 

lj:i:0<lXi<^lX2 M2e[{l-e)A2,(l+e)A2] Mie[(l-e)Ai,(l+e)/ii] 

— min lim min -R2(a*i, A*2, /^i, ^(2) 

M2e[(l-e)Ai2,(l+e)A2] Ml^+0^tie[(l-e)Al,(l+e)/il] 

= min lim -R2((l + e)/ii, /X2, /ii, At2) 

;i2e[(i-e)A2,(i+e)A2] Ai-s>+o 

^ ^ , hni i?2(//i,//2, (l + e)"Vi,/i2) 

/U2e[(l-e)M2, (1+6)^2] 

/U2e[(l-e)/i2,(l+e)/i2] i + e i^I^+PO P2,x 

„ g _|_ E2. 

- (1 + e)yi2e-(^+^)'^^(-^ +po)(l - /^( , ' )) + e-(^+^)>o -P2,xr7/i(-^''" ^ 



1 + e iT^+^'o ' P2,x 



Finite-key analysis of the decoy method 



30 



where the final equation follows from (116) and the following fact. The function 
X I—)- xe~^ + ae~^ is monotone increasing when x < 1 — a for a > 0. □ 

The rates i?i(/ii,/i2) and R2{fj'i, fi'2) are numerically calculated with s = 0.03, 
Po = 4.0 X 10^"^, a = 1.0 X lO^'^ as Figures 5, 6, 8, 7, and 9. Indeed, when e = 
and fli is fixed, the rate Ri can be maximized with the limit fi2 f^i- However, as 
is shown in Figure 5, when there exists error, the rate Ri goes to zero with the limit 
/i2 — )■ yUi. As is shown in Figures 5 and 8, Both rates Ri and R2 become zero with 
the limit /i2 — fii- This is because a\, goes to zero since two intensities cannot be 
distinguished when jl2 is close to jli. Figure 6 and Table 1 give the optimal intensities 
jli and /i2 for Ri. 



Rl 




Figure 5. Key generation rate Ri with jli =0.1. The horizontal axis is jl2- The error 
parameter e is chosen to be 0% (orange) 1% (blue), 3% (red), 5% (green), and 10% 
(purple) . 



Rl 

0.0001 r 




Figure 6. Key generation rate maxo<^i<^2 -^i(/^ii ^2)- The horizontal axis is /i2 ■ The 
error parameter e is chosen to be 0% (orange) 1% (blue), 3% (red), 5% (green), and 
10% (purple). 
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When jli is close to zero, the the difference jli — Hi becomes small in proportion 
to /ii- Then, as is shown in Theorem 4, the limit /ii — ?■ gives the optimal asymptotic 
rate R2 for a fixed /i2. Figure 7 and Table 2 give the optimal signal intensity /i2 for R2- 
However, in a real setting, it is quite difficult to control too small intensity. Hence, we 
consider the optimization of /i2 for R2 when /ii = 0.1, as is shown Figure 8 and Table 3. 

R2 

0.00014 - 




Figure 7. Key generation rate maxo</ii</i2 ^2(mii ^2)- The horizontal axis is fi2- The 
error parameter e is chosen to be 0% (orange) 1% (blue), 3% (red), 5% (green), and 
10% (purple). 



R2 




Figure 8. Key generation rate R2 with jli — 0.2. The horizontal axis is jl2- The error 
parameter e is chosen to be 0% (orange) 1% (blue), 3% (red), 5% (green), and 10% 
(purple). 

Note that the rate R2 assumes the asymptotic limit concerning the number of coding 
length. If we take into account finiteness of the number of coding length, we have to 
consider the statistical fiuctuations of N and M. This problem will be discussed in 
Section 11. 
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R2 

0.00014 r 




Figure 9. Key generation rate i?2 with /i2 = 0.5. The horizontal axis is fli. The error 
parameter e is chosen to be 0% (orange) 1% (blue), 3% (red), 5% (green), and 10% 
(purple). 

Table 1. Optimal intensities for Ri and optimal Ri 



e 


/ii 


P'2 


Ri 


0% 


0.323867 


0.323868 


0.000094349 


1% 


0.260721 


0.454851 


0.0000758128 


3% 


0.364856 


0.381122 


0.00139591 


5% 


0.190192 


0.613888 


0.0000551087 


10% 


0.145002 


0.7413 


0.0000418435 



Table 2. Optimal intensities for R2 and optimal R2 



e 






Ri 


0% 





0.542685 


0.000136993 


1% 





0.541796 


0.000133319 


3% 





0.539778 


0.000126128 


5% 





0.537399 


0.000119136 


10% 





0.529685 


0.000102456 



Table 3. Optimal intensities for R2 and optimal R2 when fli =0.1 



e 




Ri 


0% 


0.49672 


0.000123965 


1% 


0.49719 


0.000118152 


3% 


0.498509 


0.000106466 


5% 


0.500422 


0.0000946697 


10% 


0.482252 


0.0000641944 



9. Derivation of upper bound 04 of leaked information 
9.1. Condition for fii, fi2, and M 

In this section, we define tlie upper bound 04 (Ai") satisfying (42) as a function of the 
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treat the case when the signal intensity is /ii and the decoy intensity is H2- However, 
the discussions in this section except for Subsection 9.2 arc still valid with replacing N, 
iV°, and by N', and even when the signal intensity is /i2 and the decoy 
intensity is /ii. 

In this subsection, for this purpose, we introduce the following condition for /^i, 112, 
and M. 

Condition 6 For any N ^ fli, all of the following values are positive. 



^ ■ NlN^ - N^Nf 

A- - M ^0 ,.0 ^miM, - S^N^) - NfjM, - j^ATO)) 

Bl := M3 - MqN^/2Nq. 

Substituting M into M, and applying the relations (77), (78), and (79), we can 
calculate the above values as 

A\^{a\-e/2)Nl A\^{al-a\)Nl A\^a\Nl Al^alNl B\^h\Nl. 
Now, we show that these values take positive values, naturally. As is shown in the 

— * 

beginning of Section 6, when all of N are close to their expectations, and there is no 
eavesdrop, i.e., the condition (104) holds, a\ — g°/2 and Qj Qj CirG positive. Thus, 
Condition 6 holds under the condition (104). Since the condition (104) is a natural 
assumption, Condition 6 can be regarded as a natural assumption. Hence, we need 
to choose the parameters /ii, /i2, A^, iVo, A^i, N2 so that Condition 6 holds with high 
probability without an eavesdropper. 

Here, we need to pay attention to the difference between Conditions 6 and 5. 
Condition 5 is an assumption for /xi, /i2, iV, A^q; -^i; and A^2- On the other hand. 
Condition 6 is an assumption for the measured values M and /Xi, ^2 because the 
estimates M are determined from the measured values M via the relations (91), (92), 
(93), and (94). 

When there exists an eavesdropper, even if we choose /^i, //2, -/^o, -^i, ^2 suitably, 
the eavesdropper might control the channel parameters (f, a and h so that Condition 
6 does not hold. Hence, we need to prepare a method to smoothly decide whether 
Condition 6 holds. 

9.2. Derivation of N 

Next, we derive the pair {N'^,N^) to give 0i when q^, a^, and 6^ are given. Only 
—J^{q^, N^) depends on in the right hand side of (56), and is monotone decreasing 
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concerning iV°. Hence, (j)i{N , , , f],) is monotone decreasing concerning N'^. 

On the other hand, only —J^{q^, N^){1 — h{min{rl^{q^,b]^, N^),l/2}) depends on 
A^^ the right hand side of (56). The parameters and are monotone decreasing 
concerning N'^ and is monotone increasing concerning A^^. Since {h{rl,) — 1) 
is negative and h is a monotone increasing function with an input less than 1/2, 
J^(/i(fx) — 1) is monotone decreasing concerning A^^. 

Since and N'^ obey the binomial distributions Bin{N, e~^^) and Bin{N, /Xie~''i), 
respectively, when the signal intensity is //i and the decoy intensity is //2, we give the 
estimate AT = (7V°, 7V^) as 

Similarly, when the signal intensity is 112 and the decoy intensity is /ii, we give the 
estimate AT = (iV°, iV^) as 

:= Ff (A^',e-'^^2-2/^-S), := Ff (AT', ;,2e-^2^ 2-2/^-^). 
5.5. Derivation of Ni and N2 

Next, in order to derive the estimates of Ni and N2 giving an upper bound of (j)2{M), 
we calculate the partial derivatives of 0i concerning Ni and A^2- For this purpose, we 
calculate the partial derivatives of d\ {M, N) concerning N^, Nl, N2, N2, A^| as follows. 

dai{Mo,N,,N2) 

^ M2-Mo{N^ + Nl)/2No _ , Ni{M, - MoN^/2No) - A^f (M^ - M^N^/2N^) 
NlNj-NlNl ' {NlN^-NlNlY 

ddi{M,N^,N2) 
dNl 

^ M2 - M0NI/2N0 2. 1. iV|(Mi - MoiVi72iVo) - ^^1(^2 - MoiV272Aro) 

NlNl-NlNl ^^^2+^V2j {NlN^-N^Nlf 

dai{M,Ni,N2) ^ N^Mo/2No 

dN^ NlNl-N^Nf' 

dd\{M, N„ N2) _ Nf{Ni{M, - j^ATO) - ATf (M2 - ^iV°)) 

ddi{Mo,N,,N2) _ Mi-^N^i Nl{Nl{M, - ^N^,) - Nl{M2 - ^Nl)) 
dNl NlNl-N^Nf {NlNl-N^Nfy 

Here, we should we remark that Nf = Ni — — N^. That is, the variable A^^ is a 
dependent variable. Due to Condition 6, all of the above values are positive. 

Next, under Condition 6, we calculate the partial derivatives of b]^ (M, N) 
concerning N^, Nl, N^, N^, N^ as follows. 

dbiiMo,N,,N2) ^ Mq 
dN^ 2NlNo 
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dbj (M, Ni, N2) ^ Ms- MoN^/2No 

dNl {Niy 
dh\ (M, iVi, N2) dh\ (M, N2) dhi (M, ATi, N2) 



< 

(M. 7Vi . ATo^ ^ 



dN^ dNl dNi 

Since ^ < and |^ > 0, due to (63) and (64), any element N e Qi satisfies 

d(t)i (901 dd)i dSi dd)i 

—— < — ^ < — ^ < —-^ < — — !- < 

aiV? ' dNl ' aiVO ^ATi ' dNl 

Thus, since N^,Nl,N2,Nl, and obey the binomial distribution, we decide iVi 
(TVO, Nl) and /V"2 = (iV^, iVj, iV|) in the following way: 



rf(iVi,e-^% 2-2/3-8) 

rr(iVi,/iie-^\2-2/3-«) 
Ff(iV2,e-^% 2-2/3-8) 
yf(7V2,;,2e-'^^2-2/^-«) 
:=yf(7V2,a;2//2e-'^^2-2^-«) 

Then, when Af (iVf) satisfies Conditions 4 and 6, we define 

04(M) :=03(M(M),iV), (123) 
otherwise, we define 

04(M) := M. (124) 

— * 

Due to the definition, any element iV e Qi satisfies 

04(M) >02(M,iV), (125) 

i.e., the relation (42) holds. In summary, when the parameters /xi, /i2, N , Nq, Ni, and N2 
satisfy Condition 5, and when we choose the sacrifice bit length S{M) = 04(iVf) + 2/3 + 5 
with the above choice of 04(iVf), we obtain \\pa,e — PidealHi — 

10. Improvement of evaluation 

Up to the previous section, based on (45) given in Section 6, we give an evaluation 
of the universal composability with the finite-length setting. However, the above given 
evaluation can be improved by removing the square root for a part of probabilities in the 
following way. First, we change our definitions for estimates and the sacrifice bit- length 
in the following way. 

J%q\N^) :=F-(iV°,g°,2-/^-^) (126) 
J\al , bl ,N'):= Y- {N\ ^ + b], , 2-^-') (127) 

fl {alUN') p-'iJ'ial + blN^), 2-'^-% (128) 

Mo{Mo) :=X-(Aro, Mo, 2-/^-6), (129) 
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Mi(Mi) :=X-(A^i,Mi,2-2^-^), (130) 

M2(M2) :^X+{N2,M2,2-''^-^), (131) 

Ms{Ms) :=X+(7Vi,M3,2-2^-^), (132) 

7V° := y-f (A^i,e-''S2-^-^) (133) 

:=yf(7V,,;,,e-^i, 2-^-6) (134) 

7V° :=yf(A^2,e-^^ 2-^-6) (135) 

:=yf(iV2,/i2e-^% 2-^-6) (136) 

7V| :=rr(iV2,a;2/x^e-'^%2-^-^) (137) 

S{M) := MM) + 2/3 + 5. (138) 



When the signal intensity is /^i and the decoy intensity is /X2, we give the estimate 
AT = (iVO,iVi) as 

■= Yf{N,e-^'\2-^-^), := Yf{N, i^ie-^\2-'^-^). 

Similarly, when the signal intensity is 112 and the decoy intensity is /ii, we give the 
estimate N = {N'^,N^) as 

7V° := Y^-{N',e-^\2-^-^), := Y^-{N' , ii2e-^\2-^-^). 

Further, Condition 5 is changed as 

Ff (iVi, ^le-'^S 2-'5-6)Ff (iV2, U2^ile-''^2-^-'') 

> (iVi - Ff (iVi, e-'^S 2-''-6) - Y,-{Ni,^i,e-^\2-^-''))Y+{N2, fi2e-^\ 2-''-6), 
yf (iV2, c.'2/v|e-^% 2-^3-6)1;- (iVi, e-^S 2-^^-6) 

> (TVi -Fr(iVi,e-'^S 2-^-6) -Ff(iVi,/iie-'^S2-^-6))y+(iV2,e-'^% 2-^-6), 

y^(iV2,a;2/iie-^^2-^-^) yf (iV2,e-^^2-/^-6) 

A^i - yf(iVi,e-w, 2-/5-6) _ y-(iVi,/iie-w, 2-/3-6) y+(Ari, e-w, 2-/5-6) 
2y+(iV2,/X2e-/^^ 2-/5-6) 

yf(7Vi,/xie-'^i, 2-/5-6) ■ 

Then, we obtain the following theorem 

Theorem 5 Under the above definition, when Condition 5 holds, we obtain 

IIPAi^-Pideallli<2-^- (139) 
Now, we will show the above theorem. For this purpose, wc treat Formula (2) more 
deeply. Assume that s = (si, . . . , Sn+^i+^^+j^-^+n^) is the sequence of the indicator of 
the kinds of the generated state among all of iV + A^' + A^^q + iVi + iV2 sent states. For 
example, if the i-th received state is the vacuum state, Si is 0. if the i-th received state 
is the single-photon state, Sj is 1. if the i-th received state is the state p2, Si is 2. 
Otherwise, Si is 3. We apply (2) to the case when s and AT are fixed, we obtain 

\\Pa,e\s,n — Pideal|s,Arlli — 2^2 a/ Pph\s,N, (140) 

where Pa,e\s,n, Pidcal|sAr Pph\s,N are the final true composite state, the ideal final 
state, and the averaged virtual phase error probability with conditioned s, N. Hence, 



Finite-key analysis of the decoy method 37 
the final true composite state pa,e and the ideal final state P[(\qqI are written as 

PA,E = PA,E\s,N, 
s,N 

Pideal = Yl ^(*' ^)(*' ^1 ® ^ideal|«,iv 

s,JV 

Hence, when Q is a set concerning s,N, 

\\PA,E - Pideallli = ~ ^ideal|s,ivlli 

s,N 

< J]P(s,iV)min{2V2y^;^,2} 

s,N 

< + 2V2 I J2 ^(s,iV)Pp,|,,^. (141) 

When the signal intensity is fii and the decoy intensity is 112, for the analysis, we 
replace the definition of Oi as the following way. 

e [Yf{N, e-^'\2-^-^),Y+{N, e-^'\2-^-^)] (142) 

N' e [yf (TV, //ie-'^\ 2-^-6), y+(Ar,;,ie-'*\ 2-^-6)] (143) 

Ni e [Yi'iNi, e-'^i, 2-^-6), y+(A^i, e-^\2-^-^)] (144) 

^1' e [Yr(N,,i,,e-^\2-^-'),Y+(N,,i,,e-^\2-^-')] (145) 

^2 e [yr(N2, e-^\ 2-^-6), y+(7V2, e-'^^ 2-^^-^)] (146) 

^2 e [yr(Ar2,//2e-'^%2-'3-«),y+(7V2,//2e-'^%2-''-«)] (147) 

e [Y,-{N2,U2file-''%2-^-'),Y+{N2,uj2file-^\2-^-')] (148) 
When the signal intensity is 112 and the decoy intensity is /^i, (142) and (143) are replaced 

by 

e [Yf{N',e-^'\2-^-^),Y+{N',e-^\2-(^-^)] (149) 
e [yf (AT', ;xie-'^i, 2-^-6), y+(iV',/xie-'^S 2-^-6)]. (150) 

We choose the set Q, as 

Q := Qi n { J'^ > y-(ArO, ^, 2-^-6)} n { > y-(A^\ al + P^, 2-^-^)} n {Mo > Mo(Mo)}. 
Hence, using (141), we obtain 



\\PA,E - Pideallli < 2 • (7 • 2 + 3) • 2-^-' + 2^2 /5^ P(s, Ar)P^,|,,(;^51) 



s,Nen 



Since 04(M) > 02(M(M), N) for AT e Oi, as is shown in (125), due to (95), (96), 
and (57), we obtain 

n n {04(M) < 0(j)} c n {MM, n) < 0(j)} 

cQn ({0(J) >0i(iV,g^4,6^J}U{03(M,iV) >02(M,iV)}) 

c i^n < y- (Aro,gO, 2-^^-6)} u { <y-(7v\ 4,6^^, 2-'^-6)} 
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U{Mo < Mo(Mo)} U {Ml < Mi(Mi)} U {M2 > MslMa)} U {M3 > M3(M3)}) 

U{Mi < Mi{M,)} U {M2 > M2(A^)} U {Ma > M3(M3)} 

C {^ > p+{J\ rrxiT' 2"'''"')} U {Ml < Mi(Mi)} U {M2 > M2(M2)} U {M3 > M3(W) 

Hence, due to (138), 

5] P{s, N)Pph\s,N < Pro n {MM) < 0( J)} + 2-2^-^ 

^ . 2-2/5-7 + 2-2/3-5 ^ 2-2/3-4_ 

Thus, using (151), we obtain 

\\PA,E - Pideallli < 2 • 17 • 2-^"^ + 2V2 ■ 2=^ < (153) 

because 2-\/2 + ^(= 3.89) < 4. Indeed, in order to put out a probabihty from the 
square root, the event corresponding to the probabihty must be defined by s, N . 
Hence, the probabihties corresponding to the sets { >P^{J^, J^+l^ ' 2~'^^~'^)}, {Mi < 

Mi(Mi)},{M2 > M2(M2)}, and {M3 > M3(M3)} cannot be put out from the square 
root. 

In summary, when the parameters Hi, //2, N, Nq, Ni, and N2 satisfy Condition 
5 modified in this section, and when we choose the sacrifice bit length S{M) = 
04(iW) +2/3+5 by using the choice of 04(iW") given in (123) and (124) and the parameters 
given in this section, we obtain \\pa,e — PidealHi — 2~'^- 

11. Asymptotic optimization of decoy intensity //i 

11.1. Asymptotic expansion ofb]^{M{M),N) 

Next, for a given signal intensity, we consider the minimization of the sacrifice bit length 
concerning the decoy intensity by taking into account statistical fiuctuations with an 
asymptotic setting. As is already discussed in Section 8, it is better to make the decoy 
intensity smaller than the signal intensity. Hence, in the following, we consider the 
case when the signal intensity is 112 and the decoy intensity is /xi with fii < fj,2- While 
the optimal decoy intensity is zero in Theorem 3, this argument does not take into 
account statistical fiuctuations. Hence, we need to optimize the decoy intensity ni with 
the choice of N and M(M). 

Due to Theorem 3, the optimal decoy intensity converges to zero when N', Nq, 
Ni, and N2 go to infinity. Now, based on the model (104), we consider the case 
when No = CoN', iV, = qiV', Mq = poNo, Mi = ((1 - s){l - e-^^^O + Po/2)iV,, and 
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Mj+2 = - e-'*''') +po/2)Ni for i = 1,2. Choosing /ii = we derive the 

asymptotic expansion of 4>4{M)/N' up to the order j^Ttji- The purpose of this section 
is to optimize A. 

For this optimization, we have to treat two kinds of factors. One is the speed of the 
convergence to the asymptotic rate. The other is the asymptotic rate. With respect to 
the finite-length key generation rate, both factors add negative terms to the asymptotic 
key generation rate when the parameters a\ and fe^ are perfectly estimated. These 
terms appear as terms with smaller orders than N. The absolute value of the term by 
the first factor is monotonely increasing with respect to the decoy intensity, and that by 
the second factor is monotonely decreasing with respect to the decoy intensity. Hence, 
we have to address the trade-off between two terms. 

Indeed, if wc choose a smaller order than for the decoy intensity ^i, the 

absolute value of the term by the first factor has a larger order than that by the second 
factor. That is, the optimal coefficient is infinity. If wc choose a larger order than jj^ji 
for the decoy intensity /xi, the absolute value of the term by the second factor has a 
larger order than that by the first factor. That is, the optimal coefficient is zero. In 
both cases, the asymptotic expansion is not valid with such extremal cases. In order to 
address the above trade-off, we need to choose the order of the decoy intensity ni such 
that the both terms has the same order. This requirement is satisfied when the decoy 
intensity behaves as 

In the following, we first treat the asymptotic expansion of b]^ {M{M), N) up to the 

order Using the discussion in Appendix C, we obtain the asymptotic expansions 

of Mo(Mo)/iV', Mi(Mi)/iV', M2iM2)/N', M^{M^)/N\ N^JN', Nl/N\ N^/N', N^/N', 
N^/N', N^N', and N^/N' as follows. 

Mo{Mq)/N' = copo + ^J CqPq{1 - Pq)xq^^ + o{^^), 

M,m/N' = c,(| + (1 - - e--)) - ^c,|(1-|K^ + o(^), 
Mm/N' = C2(| + (1 - ^)(1 - e--^^)) + o(^), 
Ms{Ms)/N' = c,(| + .(1 - e--)) + ^c,|(l - + o(^), 

7VO/7V' = c,e--+o(^) 

Nl/N' = ci/.ie-'^^ + o(^) = ci/xie-'^^l + o(^)) 
N'JN' = cu^^^le-^^ + o(^) 

Nl/N' = C2^i2e-^' + o(-^) 
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Nl/N'^C2U2iile-^'+oij^) 

N^/N'^e-^^+o{^) (154) 

iVViV' = /X2e-^^+o(^), (155) 



^2 



where and Xq are defined as 2 ^ ^ = r°° ^-^dx and 2 '^^ — f°° ^-^dx 
^. Relation to the latter discussion, we need asymptotic expansions for 
Mo/A^', Mi/N', Ms/N', N^/N', Nl/N', N^/N' up to the order 

First, we treat the asymptotic expansion for b]^{M, N) 

M3 - MoN^/2No 
N' 



(c.(| + .(l-e-),.yc,f(l-|K^.o(J^,, 

- 2^(coPo + a/coPo(1-Po)2:i^ + o(^))(cie-'^i + o{^)) 
ci(y + s(l-e '^^)) + yci-(l-y)a;i^ 

- cie-'^^y - ^e-^^ \/po(l -Po)/coa:o-^^ + o(-^^) 
ci(?(l - e--) + .(1 - e--)) + Jc/^{1 - P^)x, ^ 



2 V /V V 2 ' 2 ' Ar'V2 

- |e-'^VPo(l-Po)/coXo^ + o(^) 

ci( — (l-e-''^) + s(l-e-"'^i)) 
2 



+ (V^iy (1 - - |e-Vpo(l-Po)/coXo)-^ + o(-i^). (156) 



Since the order of ci/xie"''^ is j^rt/i, using (114), we obtain 
M3 - Mo7V°/27Vo 

f (e'^i - 1) + s(e'^i - e(^-")''i) 



/ii 

Vcif (l-f)a;i-fe-^Vpo(l-po)/coa;o 1 1 
= .a+- + (F,A + )^ + o(^), 

^ If we do not employ the central limit theorem, we can employ Chernoff bound, i.e., given in 
Appendix A. In this case, as is discussed in Appendix C, Xi and xq are defined to be w '^'"i^'^J^ and 



2(/3+6) 
loge ■ 
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where 

Fi:=ls{l-{l-ar) + ^, G, := ^^(1 - |), := ^ Vpo(1 - Po)/co. 
Hence, 

= set + — - + (FiA H r ) -TT + 0( -7j). 

ii.^. Asymptotic expansion ofh\{M,N) 

Next, we treat the asymptotic expansion of a\{M,N) up to the order -^^jrji- Since 
^iV^^' = O(^), and Nl/N' = O(^), 

Since CiC2UJ2e~''^~''^lJ>ilJ>2{lJ'2 - A*i) = 



TV^TV^^ - TV^TV/ = ciC2a;2e-''^-''^/ii//2(//2 - (1 + (157) 

Similar to (156), we have 



Ml - MoN^/2No 
N'' 

c,{?^{l - + {I - s){l - e--n) 



cif (1 - f )^i + |e-^VPo(l-Po)/coXo)^ + o(^), (158) 

whose order is 0(-^^^) because Ci(po(l — e~''i) + 1 — e""'^^) — 0{j^jyi^). Since 
^1 = we obtain 

ATI (Ml - MoN^/2No) - N^{M2 - MoN^/2No) 



= C2a;2/x^e-'^^ci(^(l - e'^^^) + (1 - s){l - e-^^) 



-C2a;2/^2e~^HWciy(l - -j)xi + ■^e-^VPo(l - Po)/coa;o)-^^ 

- c,U2i^le-^^C2{^{l - + (1 - 5)(1 - e--n) + o{^). (159) 
On the other hand. 



C2a;2/xie-^^(vAcii|(l - ai)xi + fe-m ^^^(i _ p^)/^^^;^) 1 

€1020026- f^-f^ 1^11^2(1^2 - Ail) 
_ GiXi + ^2X0 1 . 1 , 
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Using the quantities 

F2{fi2) := (1 - s + — ) -1 

_ ^ e(^-")/-^ - 1 - (1 - a)i^2 - (1 - a)Vi/2 

V-"- *J ,,2 ' 

we have 

lile-f'^ifil - e-^i) + (1 - s)(l - e-"/^!)) - //fe-'^i(f (1 - e"^^) + (1 - s)(l - e-"'^^)) 

e-Mi-M2^^^2(/i2 - /ii) 

n=3 m=0 
n=3 

= Y + (1 - s)« - ^^lF2{^x2) + 

= f + - - + ^160) 

Due to the relation ciC2UJ2e~'^^~'^^ iiiii2{lJ'2 — A*i) = 0( ^/1/4 ), we obtain 
Nl{Mi - MoN^/No) - Nl{M2 - MoN^/No) 



ClC2UJ2e-^''-^'^Hl^i2{^^2 - l^i)N'^ 
l-s)a-{F2{^2)X + ^^^^ 
Therefore, combining (157) and (161), we obtain 



= f + (1 - .)« - (F.(^.)A + + „(_!_). (161) 



ai(M,N)= NlNI-NiN? 

Po , /-, \ r\TP/ \ , G1X1 + G2X0. 1 . 1 . 

= - + (!-.)«- [XF2M + ^ ]^ + o(^). 

Asymptotic minimization of sacrifice bit length 

When a signal pulse 1^2 is fixed, for minimization of sacrifice bit length, it is sufficient 
to maximize (a^M, N) + h\{M, N)){1 - K^j^^^^)) because N'' and N^' 
do not depend of the decoy intensity //i. Using the partial derivatives of the function 
(x,y) (x + y)(l - h{^)), we obtain 

{al {M, N) + h\ {M,N)){1- M .,, -/^i^V^.V, 

aUM,Ar) + 6i(M, AT) 

^ {po + a){l-h{ ■ )) + (l + log ■ )[AFi + 



,1 Po/2 + (l-s)a ^ ^ Gia^i + ^2X0, 11 

- + po + c ^^^^^^^^^ + A + 

/ ,/Po/2 + sa,, ,^ , C2, 1 / 1 X 
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where 

Ci := 1 + log ^ ^ -)F2{l^2) - 1 + log Fi 

C2 := 1 + log^^^^^ ^ —){GiXi + G2X0) - 1 + log i^^^ ) Gixi - G2X0). 

Po + a Po + a 

Therefore, it follows from (154), (155), and the above argument that the sacrifice bit 
length is 

M - N'e-^' - N'fi2e-''%Po + «)(!- /.( ^"/^ + ^"^ )) + y.^e-'^HC^X + ^)N''"^ + oiN'^'^) 

P0 + OL A 



(162) 



Due to the relation between arithmetic mean and geometric mean, the maximum of 
the coefficient of the order -^^7174, can be attained with A* := \J^-, i-e., = ^J^N'~^^'^ . 
Therefore, the minimum sacrifice bit length with a fixed signal pulse 1x2 is 

Po + a 

12. Analysis when the intensities cire not fixed 

12.1. Case when the intensities /ii and 112 obey the independent and identical 
distribution 

Unfortunately, many realized quantum key distribution system have fluctuation for 
the intensities. In Section 9, we have derived the secure sacrifice bit length when the 
breakdowns of A^i pulses and A'2 pulses obey the Poisson distribution. However, when 
the intensities have fluctuation, we have to derive the sacrifice bit length by taking into 

^ — * 

account this factor. That is, we need to discuss the distribution for N in the way 
different from that in Section 9. In Subsection 8.3, we have already discussed the case 
concerning the asymptotic key generation rate. In this section, we discuss the sacrifice 
bit length in the same setting. 

Indeed, the definition of (})2{M,N) docs not depend on the distribution for N. 
Hence, since it is not needed to change the definition of (f)2{M,N), the relation (34) 
holds without any modification. Thus, we need to modify the definitions of 04 (Ai") and 
the set Qi giving the fiuctuation of N so that the relation (42) holds. Further, since 
the definition of p2 given in (10) depends on the intensity /ii, we need to modify the 
definition of p2 properly. 

In the following, we assume that the intensities yUi and /X2 independently obey 
independent and identical distributions satisfying the following condition. For any 
integer n > 3, the relation 
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holds, where E denotes the expectation. Under the above assumption, we have 
expansions for two kinds of pulses. 



J2 , \^){^\ = E[e-^^]|0)(0| + E[e-''Vi]|l)(l| + Efg-'^V^Ws (163) 

77". 

n=0 

Yl , 1 ^)H = E[e-^^]|0)(0| + E[e-^^/X2]|l)(l| + E[e-^^/x^]c.2P2 + c.^P3, (164) 



ni 

n=0 

where 



P2 := 



P3 := 



UJ2 



1 ^ E[e-^^/xy] , 

— / -TF^T ^ (165) 

1 ^ E[e-^^/.^]E[e-^^/xf] - E[e-^^/x^]E[e-^^/.i] 

y^fe:^^ (167) 



n=2 

oo 



E[e-^^//^]E[e-^^//f] - E[e-^^//^]E[e-^^//^] 

Indeed, our analysis in the previous sections uses the expansions (163) and (164) and 
their coefficients. Hence, we can apply the discussion with suitable modifications in the 
following way. (A similar idea is used in Wang [13, 14].) 

In the following, wc treat the case when the signal intensity is //i and the decoy 
intensity is fi2- Then, wc obtain the same argument with the following replacement: We 
replace the definition of p2 in the above way, and define the set Qi in the following way. 

iV° e [Yf{N, E[e-^i], 2-^-^), Y+{N, Efe"^^], 2"^-'')] (169) 

e [Ff(iV,E[/iie-^^], 2-^-6), F+(iV,E[/iie-'^i], 2-^-6)] (170) 

e [rf(iVi,E[e-^i], 2-^-6), r+(iVi,E[e-'^i],2''^-^)] 

Nl e [Ff(iVi,E[/.ie-'^^], 2-^-6), r+(Ari,E[/.ie-'^^], 2-/^-6)] 

^2 e [n"(^2,E[e-'^^], 2-^-6), r+(Ar2,E[e-'^2], 2-^-6)] 

e [yr(7V2,E[/X2e-'^^],2-'^-6),y+(7V„E[/.2e-'^^], 2-^-6)] 

e [yr(7V2,E[e-'^^/i^]a;2,2-''-«),y+(7V2,E[e-'^^/i^]a;2, 2-^-6)]. 

We also define Ni and in the following way. 



:=yf(7Vi,E[e-'^i], 2-^-6) 

yf(7V,,E[/.ie-'^i], 2-^-6) 
:=yf(7V2,E[e-'^^], 2-^-6) 

yf(iV2,E[/.2e-'^^], 2-/^-6) 
yf(iV2,E[e-^>2]^2,2-^-^). 
Then, we define N by 

iV° := yf (iV,E[e"^^],2^'^-^) 
:= yf (iV,E[/^ie-'^i],2-'^-^) 
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Under the above modification, we change Condition 5 as follows. 

> {m-Yf{N^,E[e-''%2-^-')-Yf{N,,E[f,,e->^^],2-^-'))Y+{N,^^^^ 
Y-{N2, uj2E[i^le-^%2-^-^)Yf{N, E[e-^% 2'^-^) 

> (TVi - yf (TVi, E[e-^-%2-^-^) - Y,-{N,, Ef/iie"'^!], 2-^-''))Y+ {N^, E[e-^^], 2-^^-6), 

Yf{N2,uj2E[file-^%2-^-^) (TV^, E[e-/-^], 2-^-^) 

A^i - Yf{N^, Efe-z^i], 2-/3-6) _ Yf{Ni, E[//ie-Mi], 2-/^-6) Y+{N,, Efe-^^i], 2-/3-6) 
2y+(7V,,E[/X2e-^^], 2-^-6) 

yf(7Vi,E[//ie-Mi], 2-/3-6) ■ 

Condition 6 is redefined in the term of Qi defined above. Then, we define 04(-M') by 
using (123), (124), and Condition 6. Finally, we define the sacrifice bit length S{M) to 
be 04(-M') +2^ + 5. Then, the relation (42) holds. Denoting the final state by pa,e, we 
obtain 

IIPA,s-Pideallli<2-^- (171) 
Even when the signal intensity is 112 and the decoy intensity is /ii, the above 
arguments are still valid by modifying (169), (170), (171), and (171) in the following 
way and replacing N, N'^, and by N', N^' , and N^' . 

e [Yf{N' ,E[e-^'],2-^-^),Y+{N' ,E[e-^'%2-^-^)] (172) 
N'' e [yf (TV', E[/X2e-''^], 2-^-6), y+(7V',E[/X2e-'^^], 2-^3-6)] (173) 
7V° := Yf{N', E[e-'^2], 2-^^-^) 

:=yf (TV', E[/X2e-''^], 2-^^-6). 

Next, we treat the case when there are several candidates for the distribution of 
II2 and III while 112 and /ii obey independent and identical distributions. The possible 
distributions is denoted by Pg i and Pg^2, and the expectation is written by Eg. Then, 
we denote the set fli under the distribution by fli,g. 

In this case, Conditions 5 and 6 are needed to be satisfied for any 6. Hence, 
Condition 5 is redefined as follows. That is, the following relations hold for any 9. 

yf (iVi, Eeiiiie-^^], 2-^-^)yf (iV2, u;2\eEe[i^le-^'],2-^-') 

> (A^i -yf(Ari,E4e-''^], 2-'3-6) -yf(Ari,E4/xie-''^],2-^-6))y+(7V2,E,[//2e-^^], 2-^^-6), 
yf (7V2, U2ieEe[l^le-^%2-^-<')Y{-(N, Eo[e-^% 2"^-^) 

> (A^i -yf(Ari,E4e-^^], 2-^3-6) -yf(7Vi,E,[/xie-''i],2-'3-6))y+(7V2,E,[e-^^], 2-^^-6), 

yf(Ar2,a;2|gEg[/iie-/-^], 2-/3-6) yf (TV,, Eg [e-/-^], 2-/3-6) 

TVi -yf(7Vi,Ee[e-/'i], 2-/3-6) -yf (AT,, E,[/xie-/^i], 2-^-6) y+(7V,, E,[e-/^i], 2-/3-6) 
2y+(iV2,E,[/X2e-/-^], 2-/3-6) 

yf(iVi,Ee[A^ie-/'i], 2-/3-6) ' 
where uj2\0 is 002 with the distribution Pg i. 

Further, we redefine Condition 6 as the condition that all of C°, C|, C2, and 
C| are negative for N G DqVLi^q. We define 04^5)(Af ) to be <j)i{M) given in (123) and 
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(124) when the true distributions arc Pg i and Pg^2- Finally, we define the sacrifice bit 
length S{M) by supg 04^5i(M) + 2/3 + 5. Then, letting pA,E\e be the final state with the 
true distributions Pq^i and Pe,2, Pideal \e ^® ideal state, we obtain 

\\pA,E\e-PidealJi<'^~^- (174) 

That is, the inequahty holds for any 9. 

In the following, we consider the case when the pulses are generated with the 
mixture of the plural independent and identical distributions Pg^i and Pg^i, respectively. 

Then, the intensities of iV + A^i pulses are described by (/ii^i, . . . , /ii,jv+jvj and are 
subject to the distribution ^ePgi^^^^\ where P^^ is the iV-fold independent and 
identical distribution of P. Similarly, the intensities of A^' + N2 pulses arc described by 
(/i2,i, • • • , 1^2, N2) s-iid are subject to the distribution XgP^^^. Since the final state is 
Zle ^ePA,E\e, we obtain 

\\Q2^6PAE\e) - (XI Videal|e)lli < XI ^^H^^'-^l^ ~ ^ideal| Ji ^ 2-^- (l^^) 

e e 6 

Hence, the universal composability is upperly bounded by 2~^. 

12.2. Case when the distributions of intensities pi are p2 are not fixed 

Finally, we consider the case when the distribution of intensities pi arc p,2 arc 
changed during one coding block. For simplicity, we treat the case when there are 
two distributions. That is, the intensity pi obeys the distribution Pg i or the other 
distribution Pg',!, and the other intensity p2 obeys the distribution P^ 2 or the other 
distribution Pt,',2- 

Then, we assume that the intensities {pi,i, . . . , pni) of A^i pulses satisfy Pq ^ ^'^ x 

Pg^^^'^', and the intensities {p2,i, ■ ■ ■ , P2,N2) of N2 pulses satisfy P^^2^^''' x P^^^^'**', where 
A^i = Ni\e + N-i\ei and N2 — A^2|r) + -^2|»7'- We denote the state p2 defined in (165) 
and the real number L1J2 defined in (167) under the distribution u>2 by p2\e and uj2\e, 
respectively. We also denote q^, and 6^ under the distribution U2 by (f^^ and 6^'^, 
respectively. Then, we denote the breakdown of Ni\g pulses by {N^q,N^q,N^q). We 
make the same definitions for 9' . 

Defining iV? := N% + N%,, N} := Nl^, + TVi,,, iVf := iVj, + N^,,, ql := 

9l\9N?\e+?ll0'%0' T2 ~^l\o^ne+~^l\e'%e' . P2,x|eA'iV+''2,x|e'^'|,, . 
— ^v#^ —, Ox •= hv?^ ^' ^'^^ P'^^x •= ^' 

following expansion of the pulse subject to the distribution P^ 2- 



+ 4|{iv2 ,),^P3|„, (176) 



n 

n=0 
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where 

P% ■■=-rY.^^v[e-'''l^2] ^ )\n){n\ 



"2,x|e "2,x\e' 



1 j:(E,[e--;.^] - ' )\n){n\ (177) 



and 

'^2,x|e '^2,x|e' \-i 



'^2|(JV2g,JV2^,) ^2 ) e [^2,x|min,^^2,x|max] (178) 

^^^^^ Tq:, — iq:, ) (1^9) 

n=3 1- 

'^2,x|e '^2,x|e' 

^2,x|min nim(a;2,x|6»,^2,x|6i')> ^2,x|max niax(6t;2,x|6i, ^2,x|6»')- (180) 

Next, we denote the breakdown of A^2|r? pulses by (-^2|r?' -^21??' -^217?' -^2|r?)- 
denote (f and h\ under the distribution P^_2 by g^l^ and 6^1'', respectively. We make the 
same definitions for 77'. 

Defining N^, := N^^^ + iVO^„ := iV^i^ + iVi^„ iV| := iVj^ + iV^^,, and 
iV| := iV||^ + we obtain the following relations by the same way as the relations 

(65), (66), (67), and (74). 

Mo = (fNo 

Ml = + al Nl + al (181) 



M2 = |iVO + -a\Nl + -a\Nl + ^ |^7V||^ + 4|.'^2%' 

M3 = yiVO + feiiyi + fe^iV^ 

Hence, using the same way as Subsection 7.2, we obtain the upper bound of by solving 
the above equations with P3,x|?? = P3,x|??' = ^x|»j ~ ^x|r?' ~ 0. That is, defining 

9°(Mo) := 

_ 7V|(Mi - Mo7V°/2iVo) - iVf (M2 - MoAro/2Aro) 

we define 

03(M, iV) := 0i(iV, g°(Mo), (M, iV), 6^, (M, iV)). 



Finite-key analysis of the decoy method 48 

Hence, the same arguments as the previous discussion hold with the following 
replacement. 

In the following, we treat the case when the signal intensity is fii and the decoy 
intensity is /X2- Then, the set f^i is redefined as the set of N satisfying the following 
conditions. 

iV° e [minFf (Ar,Ee[e-'^^],2-^-^),maxr+(iV,Ee[e-^^],2-'^-^)] (182) 



e [minY-f (A^,Ee[//ie-'*i],2-'^-^),maxy+(Ar,E4/xie-'^i],2-''-^)] (183) 



e [minrf(iVi,E4e-'^i], 2-^-6), max r+(iVi,E0[e-'^i], 2-^-6)] 

9 

Nl e [minrf(iVi,E4/iie-'^i], 2-^-6), maxF+(Ari,E,[/xie-'^i], 2-^-6)] 

9 

e [minrf(Ar2,E4e-'^^], 2-^-6), maxy+(A^2,Eje-''2],2-'3-6)] 
Nl e [minyf(iV2,E,[/X2e-'^^], 2-^-6), max y+(7V2,Ej//2e-'^^],2-''-6)] 

rj rj 

Nl e [mmFf (iV2, E^[e-^^/x2]a;2,x|min, 2-^^-6), max r+(7V2, E^[e-'^^/.2]^2,x|max, 2"^"^)]. 

Then, the relation Pr(iV e QJ) < 14 • 2'^'^ holds. We define and N2 as 

TVf := minFf (iVi, Eg [e-^i], 2-^-6) 

TVj^ := minrf(Ari,E0[^ie-''^], 2-^-6) 

:= minFf (A^2, E^fe-'^^], 2-^^-^) 

Nl := minFf (A^s, E^[/i2e-^^], 2-^^-^) 
»? 

7V| := minFf (iV2,E,[e-'^^//2]a;2,x|min,2-^-^), 

and iV as 

iV° := minFf (AT, Ee[e-''i], 2-^^-^) (184) 

6 

N^ := minFf (A^, E^/Xic-^^], 2-^^-^). (185) 
Then, Condition 5 is modified to 

minFf (A^i, E,[/xie-'^i], 2-^-^) minFr(Ar2, a;2,x|minE,[/x^e-^^], 2-^-^) 
v 

> max(A^i - Ff (A^i, E^e'^^], 2-^^-6) - Ff (AT^, E,[//ie-''i], 2-^^-6)) maxF+(Ar2, E^[//2e-''^], 2-'3-6), 
minFf (Ar2,a;2,x|minE,[//^e-'^^], 2-^-^) min Ff (AT, E^e"'^^], 2-^-^) 

> max(Ari - Ff (A^i, E,[e-'^i], 2-'5-6) - Ff (AT^, E,[/.ie-'^i], 2-'5-6)) maxF+(Ar2, E,[e-''%2-''~^), 

9 r) 

min^ Ff (ATs, a;2,x|minE^[/x^e-''2], 2-^^-6) ^ min^ Ff (A^2, E^fe'^^^], 2-^-^) 



> 



maxe ATi - Ff (ATi, E^e-A'i], 2-/^-6) - Ff (AT^, E,[//ie-Mi], 2-/5-6) j^ax, F+(Ari, E,[e-^i], 2-^-^) 
2max^F+(Ar2,E^[/X2e-^^],2-^-6) 
mine Ff(Ari,E,[/xie-'^i], 2-/5-6) ' 
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When Condition 5 holds under this modification, Conditions 1 and 2 hold with any 
N E Qi- Then, we define 04(iW) by using (123), (124), and Condition 6 concerning the 
above defined set Qi. Defining the sacrifice bit length S{M) as 04(iVf) + 2/3 + 5, we 
obtain (42). The final state pa,e satisfies 

||pA,£;|e-Pideal|Ji ^ 2-'^- (186) 
That is, we derive the sacrifice bit length S{M) whose security is guaranteed. 

Even when the signal intensity is ^2 and the decoy intensity is ^i, the above 
argument are still valid by modifying (182), (183), (184), and (185) in the following 
way and and replacing A^, A^'', and A^-^ by A^', A^"', and A^"*^'. 

e [mmYf{N',Er,[e->'^],2-f^-^),maxY+{N',E,^[e-^'%2-^-^)] (187) 
N^' e [mmYf{N\E^\ji2e-^%2-^-''),msixY+{N',E^\ji2e-^%2-^-'')] (188) 

m := minFf (AT', E„[e-^2]^ 2-^-6) 
■n 

m' := minyf (AT', EJii2e~''% 2'^-^). 

V 

When there are more than 3 candidates for the distributions Pi and P2, generahzing 
the definition of Jli and Condition 5, we can define 04(iVf) and the sacrifice bit length 
S{M) := 04(M) + 2^ + 5. Then, the relation (186) holds. 



13. Numerical compcirison 

Finally, we treat numerical analysis with the finite-block length. In the following, 
we consider only the case when the signal intensity is /i2, the decoy intensity is /ii, 
A^o = A^i = A^2 = A^yiO, and /3 = 80, i.e., the trace norm is less than 2"^°. 



13.1. Fixed intensities 

First, we treat the case with two fixed intensities fj,i and H2- It is natural to assume 
that the measured values Mq, Mi, M2, and M3 are given as 

Mo = poNo, Ml = (pi,x - si,x)iVi (189) 

M2 = (P2,x - S2,x)iV2, M3 = si,M (190) 

with 

Pi,+ = Pi,x = 1 - e-"'^' +Po, = s,,x = s{l - e-^'^O + f ■ (191) 

We choose N' to be M'/p2^+. Then, we consider the key generation rate 

M' - S -r]h(^)M 
R := . (192) 

where S is the sacrifice bit length given in Section 10. 

As is illustrated in Figs. 10 and 11 with /ii = 0.1, a = 1/1000, po = 0.0000004, 
T] = 1.1, the key generation rate is close to the asymptotic key generation rate P2(a*i, A*2) 
when the length of the code M is increasing. 
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We show that the asymptotic key generation rate -R2(/^i, /^2) is monotone decreasing 
concerning fii in Theorem 3. However, as is illustrated in Fig. 12 with a = 1/1000, 
Po = 0.0000004, 7] = 1.1, the key generation rate is not monotone decreasing concerning 
/ii when the length of the code M is not sufficiently large. That is, too small /ii does not 
give a good key generation rate. This is because smaller fii yields a larger estimation 
error. 

Substituting the approximation formula for the sacrifice bit length (162) into (192), 
we obtain an approximation rate R of the key generation rate R. As is illustrated in 
Fig. 13 with /i2 = 0.5, a = 1/1000, po = 0.0000004, r] = 1.1, the approximation rate R 
is close to the rate R when the length of the code M is sufficiently large. However, as 
is illustrated in Fig. 14 with /is = 0.5, a = 1/1000, po = 0.0000004, r] = 1.1, when the 
length of the code M is not sufficiently large, the approximation rate R is not so close 
to the rate R, but the shape of graph of R is similar to that of R. 




i I mu2 

0.2 0.3 0.4 0.5 0.6 0.7 

Figure 10. The above graphs describes the rate R given in (192) as functions of ^2 
when Hi = 0.1. The pink line is the case with M — 10^. The orange Hne is the case 
with M — 2 X 10^. The ref Une is the case with M = 3 x 10^. The green Hne is the 
case with M = 5 x 10^. The purple line is the case with M = 10^. The yellow line is 
the case with M — 10^. The blue line is the asymptotic case. 




Figure 11. The above graphs describes the rate R given in (192) as functions of M 
when fi2 = 0.5. The orange line is the case with = 0.01. The red line is the case 
with Hi = 0.05. The purple line is the case with fii = 0.1. The yellow line is the case 
with /zi = 0.15. The pink line is the case with /ii — 0.2. The blue line is the case with 
fii = 0.25. 



R 




0.2 0.3 0.4 0.5 0.6 0.7 



Figure 12. The above graphs describes the rate R given in (192) as functions of ^2 
when M = 10^. The orange line is the case with /ii — 0.01. The red line is the case 
with Hi = 0.05. The purple line is the case with fii ~ 0.1. The yellow line is the case 
with /ii = 0.15. The pink line is the case with /xi = 0.2. The blue line is the case with 
Hi — 0.25. The green line is the asymptotic case with hi — > 0. 
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0.05 



0.10 



0.15 



0.20 



Figure 13. The vertical axis describes the rate. The horizontal axis describes the 
decoy intensity /^i All graphs give the rates with M = 10^ and 112 = 0.5. The green 
line is the rate R given in (192). The red line is the approximation rate R. The blue 
line is the approximation rate R. 

R 



0.00012 



0.00010 



0.00008 



0.00006 




mul 



0.05 



0.10 



0.15 



0.20 



Figure 14. The vertical axis describes the rate. The horizontal axis describes the 
decoy intensity fii. All graphs give the rates with AI — 10^ and /12 = 0.5. The green 
line is the rate R given in (192). The red line is the approximation rate R. The blue 
line is the approximation rate R. 



13.2. Gaussian distribution 

Next, we treat the case when two intensities /ii and 112 obey the Gaussian distributions 
with the averages fbi and /J2 and the standard deviations fbit and fb2t, respectively[]. 
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In order to calculate the sacrifice bit length given in Subsection 12.1, we need E[e^'], 
E[/ije'^*], E[/i|e^'], and U2, which can be easily calculate from the calculations given in 
Appendix D. In this case, due to (D.6), it is natural that pi^x, Si^^, and Si^x are 
given as 

= p,,x = 1 - E[e-"^'] +po = l- e + po (193) 
= s,,x = sil - E[e-"^>]) + ^ = s(l - e """^'''"' ) + |. (194) 

Hence, the measured values Mq, Mi, M2, and M3 are given by (189) and (190) with 
the above Pi^x and Si^x- We choose N' to be M'/p2,+- Then, substituting the sacrifice 
bit length given in Subsection 12.1 into the key generation rate R (192), we obtain the 
numerical calculation in Figs. 15 and 16. 




Figure 15. The vertical axis describes the rate R. The horizontal axis describes the 
signal intensity /i2. All graphs give the rates R with M = 10^ and /ii = 0.1. The green 
line is the rate R with t = 0%. The blue line is the rate R with t — 10%. The red line 
is the rate R with t = 30%. 
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0.00002 



0.00001 - 



mu2 



Figure 16. The vertical axis describes the rate R. The horizontal axis describes the 
signal intensity fi2. All graphs give the rates R with M = 10^ and = 0.1. The green 
line is the rate R with t = 0%. The blue line is the rate R with t = 10%. The red line 
is the rate R with t = 30%. 



14. Conclusion and further improvement 

In this paper, in the BB84 protocol with the decoy method, based on several observed 
values, we have derived the required sacrifice bit-length S{M) = 04(A^) + 2(3 + 5, 
where 04(Ai") is given in (123) and (124). Under the above sacrifice bit-length, we have 
shown that the final keys satisfy the security condition \\pa,e — PidealHi — ^ when 
the parameters /xi, /i2, N, Nq, Ni, and N2 satisfy Condition 5. Hence, in order to 
apply our formula, we need to choose the parameters /xi, /i2, A^, A^o; ^i, and N2 so that 
Condition 5 holds. This is a definitive requirement for our analysis. However, when we 
choose sufficiently large integers A^, Nq, Ni, and N2 for the two values fii and fi2 — fJ'i, 
Condition 5 holds. Indeed, when the two positive values fii and fi2 — /^i are quite small, 
we need to choose quite large integers N, Nq, Ni, and N2. As the second requirement, 
we need to choose the parameters fii, /i2, A^, A'q, A''i, and A''2 so that Conditions 4 and 
6 hold with a high probability when there is no eavesdropper. This requirement is also 
satisfied when the integers A^, Nq, Ni, and A"2 are sufficiently large and the noise in the 
channel is sufficiently small. 

Since the decoy method has so many parameters, it is quite difficult to derived 
tight evaluation. The proposed method might be improved by modifying several points. 
However, such a modification might make the protocol complex. For example, while 
we treat the decoding phase error probability and the estimation error probability, 
separately, Hayashi and Tsurumaru [32] treated them jointly. In order to keep the 
simplicity, it is better to treat these terms separately. Further, in Section 5, we proposed 
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to treat the probability based on the hyper geometric distribution by using the binomial 
distribution. If we treat the probabilities given in Section 7 with the hyper geometric 
distribution, we obtain a better evaluation, but our analysis becomes much harder. 

In order to treat this problem, we have to consider the trade-off between the 
complexity and the tightness of our evaluation. This kind of trade-off cannot be ignored 
from a industrial view point. If the protocol is more complex, the cost for maintenance 
becomes higher. In particular, when we change the arrangement of the total system or we 
change the parameter of the system, we have to rewrite the program for calculating the 
sacrifice bit-length. If the protocol is simple, the change can be easily done. Otherwise, 
it spends some additional cost. Hence, we have to take into account this trade-off. Due 
to the property, our treatment is heuristic. 

However, its systematic treatment might be possible partially in the following sense. 
Assume that we employ the Renner's formalism. If we parametrize the channel with 
more parameters to be estimated, the asymptotic key generation rate becomes better. 
One might consider that if the number of parameters describing the model increases, 
we obtain a better estimation of the model. However, it is considered that it is not 
true in statistics. This is because if we do not have enough data to characterize 
so many parameters, we obtain a larger error. In order to resolve this problem, we 
have to treat the trade-off between the error and the number of parameters. Such a 
problem is called the model selection. In order to treat this problem quantitatively, we 
can use several information criteria, Akaike information criterion (A1C)[41], Takeuchi 
information criterion (TIC) [42], and minimum description length principle (MDL)[43]. 
If we employ the Renner's formalism, and increase the number of channel parameters 
for precise description of channel, we need to consider this kind of trade-off. Currently, 
it is not known that what kind of information criterion is suitable for the above our 
trade-off. 
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Appendix A. ChernofF inequality 

In this section, we derive a lower bound of the lower percent point Y~{N,p,a) with 
probability a by using Chernoff inequality. When the random variable X obeys the 
binomial distribution Bin{N,p), Chernoff inequality 

Pp{X < Nq} < exp{-ND{q\\p)) (A.l) 
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holds with q < p, where the relative entropy D(q\\p) is defined as glog - + {l — q) log j^, 
where Pp is the distribution when the success probability with one trial is p. 

Hence, letting q~ be the solution of the equation D{q\\p) — — concerning q with 
q < p,we obtain 

Pp{X < Nq-} < ex.p{-ND{q-\\p)) = a. (A.2) 

That is, we obtain Y~{N,p,a) > Nq'. Similarly, letting g+ be the solution of the 
equation D(q\\p) = —^^f^ concerning q with q > p, we obtain Y~^{N,p, a) < iVg+. 
Further, combining Pinsker inequality D{q\\p) > 2(loge)(p — qY, we obtain 

Pp{X < Nq} < exp(-2(loge)7V(p - qf). (A.3) 

Hence, solving the equation 2(loge)(p — qY — — concerning q, we obtain two 



solutions q ■= P - \J 2(\S'e)N and g+ : = p + 2{\ogl)N - ^hen, we obtain Y {N,p, a) > 
Nq- and Y+{N,p,a) < Nq+. 

Using the information geometry, we have a better evaluation than Pinsker inequality 
as follows. The relative entropy can be written with an integral form as follows [44]. 



D{q\\p) _ r t-p 
loge X t{l-t) 



dt. (A.4) 



We consider only the case p < 1/2. When q < p < 1/2, we have 

Di<l\\p) > jP - g)' (j^ .^ 

loge - 2p(l-p)- ^ • ^ 

Hence, solving the equation 2p(i-p) ~ -"i^^ge) concerning q, we obtain the smaller 

solution := p — ^ po"e)l/ • Then, we obtain Y-(N,p, a) > Nq- . 

The treatment for Y~^{N,p, a) is a little complex. When p < q < 1/2, we have 

loge - 2g(l -q)' ^ ' ' 

Hence, solving the equation = concerning q, we obtain the larger solution 

p-log a/{N log e)+A/(-p2+p-log a/{2N log e))- (-2 log a)/{N log e) , , -+ ^ i /o 

- 1-2 log a/(jV loge) " ^hcu, whcu q+ < 1/2, WC 

obtain Y^{N,p,a) < Nq^. Indeed, since g"^ is complicated, we introduce a simpler 
upper bound, since \/a-\-h < \fa + \fh, 

p- log q;/(A^ loge) + +P)(-21ogQ;)/(A^loge) + ^J i^o^a/{N\o^e)Y 



q < q 



1 -2\oga/{N\oge) 



_ p-2\oga/(N\oge) + ^/^(l -p)(-21ogQ;)/(A^loge) 
~ 1 - 2 logo;/ (A^ loge) ' 

Then, when q+ < 1/2, we obtain Y+{N,p, a) < Nq+. 
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Appendix B. One-sided interval estimation 

Appendix B.l. One-sided interval estimation based of F distribution 

We consider lower one-sided interval estimation with the confidential level 1 — a when 
we observe the value k subject to the binomial distribution Bin{N,p) with the trial 
and probability p. 

For this purpose, we fix an integer k and define the constants 

n, 2(7V - ^ + 1), := 2k, f, - I^iljl^, (B.l) 

rii p 

it is known that the random variable F(ni, 77,2) subject to F distribution with the freedom 
(ni, 712) satisfies 

i=k ^ ^ 

Our task is solving Pp{X > k} = \ — a concerning p with p < jf for a given k. Define 
f^ to be the solution of P{F{ni,n2) > /i} = 1 — a concerning /i. Then, the solution 
p — niP+n2 satisfies the equation ^^^^ = /i ■ Thus, we obtain 

P n2 {X>k} = l- a. (B.3) 

"i/r+"2 

That is, — — is the lower confidence limit p^~HN, /c, a) of the lower one-sided interval 
estimation with the confidential level 1 — a when we observe the value k. 
Similarly, we fix an integer k and define the constants 

mi = 2{k + 1), m2 = 2{N -k), f^^ —7-^, (B.4) 

m2 (1 -p) 

it is known that the random variable F{mi,m2) subject to F distribution with the 
freedom (7711,7712) satisfies 

P{F(7ni, 7712) > M = Pp{X > k} (B.5) 

Our task is solving Pp{X > k} = a concerning p with p < for a given k. Define 
/I to be the solution of P{F{mi,m2) > f2) = O- concerning f2- Then, the solution 
p = —^l^ — satisfies the equation —rr-^ = fo. Thus, we obtain 

P m2 {X > k}(l ^ f-' = a. (B.6) 

-1/2 +-2 - -"^ 7711/2* +7712 

That is, ^^p^^^ is the upper confidence hmit p^^\N,k,a) of the upper one-sided 
interval estimation with the confidential level 1 — a when we observe the value k. 

Appendix B.2. Application of Chernoff inequality 

Assume that we observe the value k subject to the binomial distribution Bin{N, p) with 
the trial N and probability p. 

For a fixed integer /c, we have 



concerning p with 4 < p, we obtain 



Pp-{-r <-r}< oM-ND{-\\p-)) = a. (B.8) 
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with < p. Hence, letting p~ be the solution of the equation D{j^\\p) — — 
A 

N 

Thus, p- <p^~\N,k,a). 

Similarly, letting g+ be the solution of the equation D{-^\\p) = —^^j^ concerning p 
with > p, wc obtain p~^ > p^~^\N, k, a). 

Further, combining Pinsker inequality D{q\\p) > 2(loge)(p — q)^, we obtain 

^^^f - - exp(-2(loge)Ar(p- (B.9) 
Hence, solving the equation 2(loge)(p — ^)'^ = — concerning p, we obtain two 
solutions p- := ^ - ^J 2logl)N and p+ := ^ + \[^^n- Then, we obtain p" < 
p^-\N,k,a). and p+ > p(+)(iV, A;,a). 



Using the relation (A. 4), we consider better bounds only for the case j^: < 1/2. 

(p-#)^ _ logo 



N 

Solving the equation = —ttt^^ concerning p with p < -|: < 1/2, we obtain the 



2^(l-|.) Af(loge) ———to/- ..X... ^ ^ 

smaller solution p~ := jj — \J ^ '^ ■ Then, we obtain p^~\N, k, a) > q~ . 

The treatment for p^~^\N, k, a) is a little complex. When < p < 1/2, we have 

loge -29(1-9) ^ ' 

Hence, solving the equation Ipii-p) ^ ~ v^fiT) concerning p, we obtain the larger 
solution p+ := ^/^-^^'^'^^^ ^^'^'^'^^^^^^^^ Then, when 

^ i — 2 log q/(A' log e) ' 

p+ < 1/2, we obtain p^~^\N,k,a) < p+. Indeed, since p"*" is complicated, we introduce 
a simpler upper bound: 



_+ ^ .+ ._ A;/iV-21oga/(Arioge) + ^/k/N{l - k/N){-2loga)/{Nloge) 
P l-21oga/(iVloge) ' 

Then, when p+ < 1/2, we obtain p^~^\N, k, a) < p"*". 
Appendix C. Asymptotic case 

Next, we discuss the asymptotic behavior of y='=(A^,p, a), p^^\N, k, a), and X^{N, k, a). 
When p < 1/2, Hence, even if p depends on N and is written by pat, if Pat converges 
to a non-zero constant p^, using p~ and p+, we obtain Y'"{N,p]^,a) > iVp^v — 
^ -2(iogaK(i-p.)iv -^^(^^ Y^N,p^,a) < Npr, + ^^^M^g^ + o(V^). If 

Pjv converges to zero, Y~{N,pn, oc) — NpN+o{\/N) and y+(A'",pAr, a) = Np]\i+o{y/N). 
In fact, if Pat converges to a non-zero constant Pa, using the central limit theorem, 
we obtain Y~{N,pN,a) — Np^ — y/pai^ — Pa)Nx -\- o^s/N) and Y^{N,pn,o) — 

A'"pjv + •\/pa(l — Pa)Nx -\- o{\/N), whcrc X is defined as a = ^-^^dx. 
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Similarly, if ^ converges to a non-zero constant Pa, we obtain X {N, k]\f,a) = 
kN - y/pa{l -Pa)Nx + o{^/N) and X+{N, kN, a) = kN + ^Pa{l-Pa)Nx + o{y/N). If 
Pn converges to zero, X~{N, kN, a) = /cjv + o{^/N) and X~^{N, k^, a) — k^ + o{VN). 



Appendix D. Calculation with the Gaussian case 

In order to calculate the sacrifice bit length given in Subsection 12.1, we need E[e^'], 
E[//je'*'], E[//^e'^'], and 002. For this purpose, we calculate e~2^^^~^'^~'^ as follows. 

— = - —{x - in - a ))e (D.l) 

dx^ 0-4^ VA- ; 

+ ((// - a^f - a2)e-^("-('^-'^'»') (D.2) 

Hence, xe-^^^^-^'^""'))', x^e-^^"-^^-"'))' can be written by using e'^^^-^''-'^'^' and 
its first and second derivatives as follows. 

rfa; 

(D.4) 



We also prepare the following formula for e 

)1 

e "e 2ct^ = e 2<t^ = e 2<t^ 



= e-i^^^-C^-^^^^^e-^^^ = e-5^(-(''-^))^^. (D.5) 

When X obeys the Gaussian distribution with the average ji and the variance cr^, 
using (D. 3), (D.4), and (D.5), we can calculate the expectations of e~^,xe~^, and x'^e"^ 
as follows. 

v27r(T^ J -00 v27r(7^ J-oo 

^^^^ m «^ 

= e 2 (D.6) 



Ebe-^l = / xe-^e-"^dx = / xe-^^""-^^-"^^^' dx 



00 



e^i^i-a') (D.7) 



e 2 



00 j2„-T^(a;-(/i-(T^))^ /.oo 

^""^ -dx + 2{^-a') xe-^(^-(-^^))^dx 



/oo 
e-^(-(^-'))^rf^) 
■00 
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^e^{{^,-a')' + a'). (D.8) 

Next, we calculate the real number uj2 when /xi obeys the Gaussian distribution with 
the average /i and the variance a^. 

1 °° 1 1 

(1 - E[e-^^] - E[/.,e-^^]) = ' ;,. Jf, , ""J . (D.9) 



Appendix E. Relation with Eve's success probability 

We consider the state pae '■— X^rn ® PAE\m, where pAE\m is the composite 
state on (C^)®™ ® He- Now, we consider a function / from U,„{0, 1}™ to {0, 1}. Then, 
we have the state Pf(A),E = J2m Pi.''^)Pf(A)E\m on ® He- Due to the monotonicity of 
the trace norm, the state Pf{A},E satisfies 

\\Pf{A),E - Pf(A) ^Pe\\< \\pa,e - Pidealll- (^-1) 

When Pf(A),E — Po|0)(0| <S> Po,E <H) Pi,e, due to the monotonicity of the 

trace norm, any two- valued POVM {T, 7 — T} on He satisfies 

\\pf{A),E - Pf{A) ^ Pe\\ 

> Po{\Typo,eT - Tt{poPo,e + PiPi,e)T\ + \ Tr Po,e{I -T)- T^{poPo,e + PiPi,e){I - T)\) 

+ Trpi,sT - Tr(poPo,£; + PiPi,e)T\ + | pi^e{I - T) - Tr(poPo,E + PiPi,e){I -T)\) 
= 4poPi| Trpo,i?7' - Ttpi^eT\. 

When T supports f{A) = and I — T supports f{A) = 1, the success probability is 
bounded by 

Po Tr Po^eT + pi Tr - T) < max(po, Pi) (Tr Po,e(-^ - T) + Tr Pi,eT) 
= max(po,Pi)(l + I Trpo,ET - Trpi,BT|) < min(po,Pi)(l + \\Pf(A),E - Pf{A) O Pe\\)- 
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